[
 {
  "id": "24b834cd-9544-480a-9127-403899348483",
  "name": "noble-nimble-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 36214,
  "username": "uftp",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T02:28:30.159476+00:00",
  "ended_at": "2026-08-26T02:28:30.267812+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "0fcad513-209d-421e-a0c7-81b876440d02",
  "name": "jovial-snowy-alpaca",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "104.43.56.65",
  "src_port": 49234,
  "username": "uftp",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 451,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T23:34:07.675480+00:00",
  "ended_at": "2026-08-25T23:34:08.892493+00:00",
  "ended_reason": "exec complete",
  "commands": 9,
  "transcript_bytes": 617
 },
 {
  "id": "3a08ac23-a703-4065-86d0-1e407ee6fc2d",
  "name": "nameless-gleaming-adder",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "104.43.56.65",
  "src_port": 53356,
  "username": "uftp",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 449,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T23:04:40.429336+00:00",
  "ended_at": "2026-08-25T23:04:42.147521+00:00",
  "ended_reason": "exec complete",
  "commands": 9,
  "transcript_bytes": 617
 },
 {
  "id": "04a79344-6711-472f-98f2-e654011aa2fe",
  "name": "tidal-earnest-mink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "104.43.56.65",
  "src_port": 33286,
  "username": "uftp",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 449,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T22:38:58.966705+00:00",
  "ended_at": "2026-08-25T22:39:01.167272+00:00",
  "ended_reason": "exec complete",
  "commands": 10,
  "transcript_bytes": 1353
 },
 {
  "id": "9623ba0b-4615-4290-b385-ee71c6ba74af",
  "name": "airy-rapid-toucan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 41434,
  "username": "uftp",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 359,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:32:55.893695+00:00",
  "ended_at": "2026-08-21T13:32:59.536682+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "05e286ee-459f-4b8a-a20a-9e116a279708",
  "name": "glacial-ivory-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 43494,
  "username": "uftp",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 178,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T18:39:50.660080+00:00",
  "ended_at": "2026-08-20T18:39:57.463464+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1649
 },
 {
  "id": "4d60f6dc-60ba-43d2-a541-676b71a8053f",
  "name": "chilly-diligent-wheatear",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 32948,
  "username": "uftp",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 184,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T11:09:18.063444+00:00",
  "ended_at": "2026-08-20T11:09:18.780877+00:00",
  "ended_reason": "exec complete",
  "commands": 3,
  "transcript_bytes": 220
 }
]