[
 {
  "id": "7a2c05d7-d1f7-4927-b366-3ad898d3786c",
  "name": "subtle-burly-goldcrest",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 50730,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:53:29.475090+00:00",
  "ended_at": "2026-08-27T12:53:30.458786+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "156ef38e-9668-4b05-bf53-1206e99e3023",
  "name": "deft-idle-godwit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 50036,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:53:23.395842+00:00",
  "ended_at": "2026-08-27T12:53:24.180134+00:00",
  "ended_reason": "exec complete",
  "commands": 1,
  "transcript_bytes": 65
 },
 {
  "id": "fe5b7c35-3ce5-4bff-b1e5-8e487ed5dab9",
  "name": "windswept-earnest-vicuna",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59540,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 443,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:15:45.537099+00:00",
  "ended_at": "2026-08-27T12:15:47.083834+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2254
 },
 {
  "id": "cc63b7a8-7d0d-4d94-9f1e-e74d6fa1408b",
  "name": "faded-nimble-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59546,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:15:28.220667+00:00",
  "ended_at": "2026-08-27T12:15:29.800059+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "b0360082-aeed-4dc0-93ca-08aceb310c4f",
  "name": "tranquil-jovial-sandpiper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 33462,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 776,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:14:52.521448+00:00",
  "ended_at": "2026-08-27T12:14:53.775731+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2254
 },
 {
  "id": "e8fb0c0e-e245-4148-b3cc-c3699a2ce4f1",
  "name": "lively-eager-cormorant",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 40198,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:14:30.209606+00:00",
  "ended_at": "2026-08-27T12:14:31.376236+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "34cbb54a-7eae-4549-a703-86074d83de0d",
  "name": "lofty-lively-crane",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59510,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 444,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:13:04.316963+00:00",
  "ended_at": "2026-08-27T12:13:05.593037+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2254
 },
 {
  "id": "f73686be-9c3a-430c-b31c-f3f2a2228069",
  "name": "smoky-blunt-macaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59526,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:12:46.992336+00:00",
  "ended_at": "2026-08-27T12:12:48.804198+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "20d9b2fa-0b3d-4b95-912e-fff636656b14",
  "name": "frosty-gleaming-tern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56218,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 293,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:07:58.895828+00:00",
  "ended_at": "2026-08-27T03:08:03.896453+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a4fd1482-0937-443c-b61c-78820424a8c2",
  "name": "lonesome-lucid-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 60806,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 291,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:56:17.197992+00:00",
  "ended_at": "2026-08-27T02:56:19.849606+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ffe590e5-8755-47cc-87cc-d65e1bb8f9e0",
  "name": "sterling-courtly-chamois",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 36300,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 230,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:54:09.361881+00:00",
  "ended_at": "2026-08-27T02:54:12.418502+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "55e91234-396d-4f32-acff-c14ee463720a",
  "name": "eager-somber-kakapo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52376,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 311,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:42:51.815739+00:00",
  "ended_at": "2026-08-27T02:42:54.516207+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2e6c0147-bb49-42de-b0c5-077422f1b90a",
  "name": "glassy-steady-barbet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 41956,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 214,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:25:42.435331+00:00",
  "ended_at": "2026-08-27T02:25:45.587250+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7b42b849-b96f-4101-86d2-d5c68274826c",
  "name": "hearty-vernal-lapwing",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 36668,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:21:18.949485+00:00",
  "ended_at": "2026-08-27T02:21:22.945501+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "337d4c9e-4e1a-4be1-a20b-31ab9a12f675",
  "name": "electric-opal-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 40830,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 420,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:21:14.704632+00:00",
  "ended_at": "2026-08-27T02:21:22.944137+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "ab54c500-ec97-4754-8ee5-7c1dae727902",
  "name": "blunt-ashen-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42320,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 422,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:32:33.358677+00:00",
  "ended_at": "2026-08-26T14:32:38.652369+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "2d2e853f-9601-45fd-88c7-50e0185449b5",
  "name": "diligent-brisk-bonobo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58080,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 425,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:05:59.105503+00:00",
  "ended_at": "2026-08-26T13:06:02.506815+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "54db11b0-3b10-4f54-be24-c013156a0b9c",
  "name": "faded-boreal-eider",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60764,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 418,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:53:48.440220+00:00",
  "ended_at": "2026-08-26T12:53:52.618704+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a5deb7d6-29a5-414c-b276-b81ef9d260d0",
  "name": "dappled-electric-lapwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 58934,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 507,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:49:31.141574+00:00",
  "ended_at": "2026-08-26T12:49:36.398589+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a3a91585-16db-40ef-9925-6393c88d998a",
  "name": "inland-tender-wren",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60120,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 619,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:32:52.418893+00:00",
  "ended_at": "2026-08-26T12:32:57.846356+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "11b0ff87-8b24-47e5-a40d-afd9351fd351",
  "name": "vivid-silent-numbat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 53008,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 355,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:00:30.420565+00:00",
  "ended_at": "2026-08-26T12:00:36.330736+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "759c44d5-79aa-42ea-8cc4-e88cff721379",
  "name": "blithe-merry-muntjac",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.12.137",
  "src_port": 48552,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 589,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T11:11:56.398052+00:00",
  "ended_at": "2026-08-26T11:11:57.985697+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2248
 },
 {
  "id": "361078a5-9995-4eeb-b74d-2b3c4d3db53f",
  "name": "forlorn-daring-chough",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 57480,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 228,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:28:00.486547+00:00",
  "ended_at": "2026-08-26T06:28:04.973671+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c72bc48a-5fe4-4cb7-beb6-431751cf38b3",
  "name": "cosmic-frosty-chickadee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 59696,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 201,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:21:10.324884+00:00",
  "ended_at": "2026-08-26T06:21:13.485433+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e816784a-f2aa-4104-b62d-5cd89d870e98",
  "name": "civil-scarlet-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 59586,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 218,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:19:41.333576+00:00",
  "ended_at": "2026-08-26T06:19:44.139021+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "137def02-9f48-44f1-9335-4f608c049836",
  "name": "mottled-graceful-parakeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 34776,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 329,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:10:30.007127+00:00",
  "ended_at": "2026-08-26T06:10:35.969727+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "953939df-00d4-443a-8377-1f1ca2afb5bd",
  "name": "wry-lucid-reindeer",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 34746,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 218,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:08:07.272996+00:00",
  "ended_at": "2026-08-26T06:08:09.889209+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "e5f0489d-9f8a-4185-87d0-5ee3cd0bfabc",
  "name": "lively-plush-heron",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.200",
  "src_port": 44208,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T05:34:17.431255+00:00",
  "ended_at": "2026-08-26T05:34:19.469228+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a86d34b9-491d-4593-801d-dba8a784646b",
  "name": "vernal-wistful-hedgehog",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 47880,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 282,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T05:34:15.367163+00:00",
  "ended_at": "2026-08-26T05:34:19.467968+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "0a533b38-c184-45f3-9eda-5646483cd2e5",
  "name": "misty-blazing-godwit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "104.43.56.65",
  "src_port": 49090,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 449,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T23:22:21.704965+00:00",
  "ended_at": "2026-08-25T23:22:23.824744+00:00",
  "ended_reason": "exec complete",
  "commands": 9,
  "transcript_bytes": 617
 },
 {
  "id": "b4bbfafc-55cd-413f-8a3e-851297ea4721",
  "name": "jaunty-misty-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "104.43.56.65",
  "src_port": 36594,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 450,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T23:20:46.685651+00:00",
  "ended_at": "2026-08-25T23:20:48.938053+00:00",
  "ended_reason": "exec complete",
  "commands": 9,
  "transcript_bytes": 617
 },
 {
  "id": "7dfdf601-f858-412e-af0e-3dbfe3902f7d",
  "name": "earnest-prickly-greenfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "104.43.56.65",
  "src_port": 59132,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 456,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T23:13:19.618503+00:00",
  "ended_at": "2026-08-25T23:13:20.984386+00:00",
  "ended_reason": "exec complete",
  "commands": 9,
  "transcript_bytes": 617
 },
 {
  "id": "44fb8cee-4471-49c8-be6d-23b3275695f8",
  "name": "graceful-hidden-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 33184,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T20:18:22.580019+00:00",
  "ended_at": "2026-08-25T20:18:22.679680+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "9f207e45-632a-4f27-84d8-f2c595494998",
  "name": "meadow-courtly-oxpecker",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 58522,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T20:16:41.586621+00:00",
  "ended_at": "2026-08-25T20:16:41.705162+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "3831a4c5-ed76-4712-b1d6-93ae99939f25",
  "name": "cunning-regal-egret",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 55592,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T20:15:01.214999+00:00",
  "ended_at": "2026-08-25T20:15:01.310337+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "99c40f92-1004-4b9c-a587-5f5726ab9834",
  "name": "shaded-forlorn-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 52688,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T20:13:33.789865+00:00",
  "ended_at": "2026-08-25T20:13:33.890006+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "0b0f1e79-8399-45ec-a2e4-200ebb4a9d19",
  "name": "watchful-graceful-skylark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 49770,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T20:12:09.820908+00:00",
  "ended_at": "2026-08-25T20:12:09.917126+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c849ad70-50ee-411c-9fd3-d0d0b18460d8",
  "name": "lonesome-gritty-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 46870,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T20:10:47.226810+00:00",
  "ended_at": "2026-08-25T20:10:47.368635+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "c4eb0bf7-322f-4118-9941-92aea8bedd4b",
  "name": "coral-prickly-dunlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.110.217",
  "src_port": 43950,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-25T20:09:26.946134+00:00",
  "ended_at": "2026-08-25T20:09:27.060260+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "31214e8e-1c6c-4634-9813-7a5ebf88835c",
  "name": "fierce-upland-kudu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 47304,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 225,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T02:08:19.593969+00:00",
  "ended_at": "2026-08-25T02:08:25.512582+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "68c2d61a-5534-4a8c-b10a-a7b645956944",
  "name": "rustic-fierce-caracal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 39482,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 238,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T02:00:28.718946+00:00",
  "ended_at": "2026-08-25T02:00:33.333038+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6ff5e5db-c0b5-4be6-a7ab-c8babc9b8924",
  "name": "hearty-twilight-sloth",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 52200,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 204,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:00:16.611871+00:00",
  "ended_at": "2026-08-25T01:00:21.341498+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d29bfccd-e3e8-47e0-b82e-458fc60ed391",
  "name": "earnest-lively-tapir",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 33322,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 216,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T00:54:52.309896+00:00",
  "ended_at": "2026-08-25T00:54:57.638670+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "63b24dc2-be03-4a2a-9e84-cf12e5d1af9d",
  "name": "jovial-dapper-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 59964,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 185,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T00:51:02.605019+00:00",
  "ended_at": "2026-08-25T00:51:07.429679+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "0651b4f2-b574-423b-82d1-10d44f2ddcc9",
  "name": "rugged-opal-cuckoo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 36384,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 256,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T00:46:48.105209+00:00",
  "ended_at": "2026-08-25T00:46:53.501570+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "23f27408-b2e3-44da-b99a-8a8c05546c5b",
  "name": "brisk-glacial-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 54608,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 206,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T10:17:36.500224+00:00",
  "ended_at": "2026-08-24T10:17:40.907597+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "a6902340-c759-4701-85d3-f8f047cd876b",
  "name": "pleasant-tawny-woodcock",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 59798,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 279,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:41:37.351149+00:00",
  "ended_at": "2026-08-24T09:41:42.225646+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ccafbb89-a5ed-47c1-8bc9-949b7675d8af",
  "name": "proud-twilight-lapwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 56270,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 272,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:37:15.511609+00:00",
  "ended_at": "2026-08-24T09:37:21.340093+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c006bc82-a257-4008-a865-dc59e32c2d98",
  "name": "blithe-dapper-mallard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 39972,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 242,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:17:02.432284+00:00",
  "ended_at": "2026-08-24T09:17:08.020423+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ec67ba7a-9b48-4274-a199-577a789d64c5",
  "name": "bashful-thorny-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 35720,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 212,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:07:21.282699+00:00",
  "ended_at": "2026-08-24T09:07:25.921260+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "26a27659-fbfe-489e-be8e-0574f184d824",
  "name": "woven-emerald-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 34820,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 210,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:03:35.301187+00:00",
  "ended_at": "2026-08-24T09:03:41.212008+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fcf4a593-d751-46f9-86e3-bf49cc93679f",
  "name": "valiant-gallant-dingo",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 60604,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T21:28:39.215464+00:00",
  "ended_at": "2026-08-23T21:28:42.543293+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "43d374c6-2996-4a69-a8a9-fe5ad0730ec1",
  "name": "plush-plucky-galago",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60562,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 476,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-23T21:28:38.484003+00:00",
  "ended_at": "2026-08-23T21:28:42.545792+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 },
 {
  "id": "88f3cd05-b667-4ddc-be89-d48ee0923904",
  "name": "dutiful-quaint-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52836,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 164,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-23T08:41:59.041641+00:00",
  "ended_at": "2026-08-23T08:42:00.632778+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 848
 },
 {
  "id": "aef4d327-9ea2-4d96-96a4-d197ced5edf7",
  "name": "hollow-inland-hamster",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 34100,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 169,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-23T08:40:33.777280+00:00",
  "ended_at": "2026-08-23T08:40:39.376571+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "40a0b8b6-5eba-4114-af8c-3cf2e2957dfa",
  "name": "somber-cunning-eagle",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 56298,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 177,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-23T08:36:13.800934+00:00",
  "ended_at": "2026-08-23T08:36:17.364131+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3bf4564b-bd7d-4aaf-8e80-b0da97ae254e",
  "name": "indigo-hidden-dunlin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "159.223.97.218",
  "src_port": 43970,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T04:13:50.759000+00:00",
  "ended_at": "2026-08-23T04:13:51.416205+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8f559fb0-7299-446b-abab-170373964af2",
  "name": "seaward-dappled-merlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 44930,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 259,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:23:21.608374+00:00",
  "ended_at": "2026-08-22T12:23:26.662247+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "cb7b8e7d-dd35-4d2f-a923-f0ada0e141fe",
  "name": "pleasant-hidden-waxwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 57214,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 214,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:19:13.885765+00:00",
  "ended_at": "2026-08-22T12:19:19.631080+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "35192940-6807-42dd-93f0-cb84030b6d1e",
  "name": "lunar-northern-dingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 38788,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 256,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:14:02.187871+00:00",
  "ended_at": "2026-08-22T12:14:05.224290+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f311c4e4-dea3-4f9d-a954-f90a9ea0bcc7",
  "name": "sullen-graceful-ibis",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 39838,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 189,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:42:01.656599+00:00",
  "ended_at": "2026-08-21T13:42:04.349349+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "0969a1b3-5d3b-40f0-a9f0-a52476ba5dc0",
  "name": "cobalt-stoic-pelican",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 44946,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 245,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:36:53.431263+00:00",
  "ended_at": "2026-08-21T13:36:56.858324+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "6fc05107-179f-44de-84ba-ada964016436",
  "name": "valiant-nimble-polecat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 46356,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 223,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:30:54.923533+00:00",
  "ended_at": "2026-08-21T13:30:59.279529+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "2fb1afff-c8f3-4705-9c48-46b88f6ce122",
  "name": "breezy-subtle-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 48484,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 270,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:29:20.739399+00:00",
  "ended_at": "2026-08-21T13:29:25.384494+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "4c356baa-0db3-44a3-afb4-7ba238d46e82",
  "name": "wooded-rapid-albatross",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 41252,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 206,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:27:08.671653+00:00",
  "ended_at": "2026-08-21T13:27:13.797854+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "0734a1c0-aa9c-4f81-b070-47dd7299b0c5",
  "name": "golden-scarlet-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 39402,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 249,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T12:50:58.154013+00:00",
  "ended_at": "2026-08-21T12:51:03.308751+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "fe422bc0-860b-4d8c-8e82-2a40aa4db073",
  "name": "indigo-dusty-stonechat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.42.147",
  "src_port": 58600,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T12:45:49.482857+00:00",
  "ended_at": "2026-08-21T12:45:51.324416+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "f4eb6f16-a893-4c13-ab6d-a7d2ddd822f1",
  "name": "sunlit-arctic-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 47480,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 268,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T12:45:45.962248+00:00",
  "ended_at": "2026-08-21T12:45:51.325552+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1658
 },
 {
  "id": "46cebaa2-8366-43ee-84b2-6357e7c3ab60",
  "name": "lively-hazy-koala",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.29",
  "src_port": 60532,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T04:42:33.473875+00:00",
  "ended_at": "2026-08-21T04:42:34.412165+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "47461822-2984-40b0-9543-41e535da15e1",
  "name": "gallant-sandy-brambling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 58622,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 191,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:44:53.901666+00:00",
  "ended_at": "2026-08-20T19:44:56.652380+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "40a98da8-f25c-42fe-85c7-bd78635945cb",
  "name": "bashful-spirited-puffin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 33010,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 175,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:41:51.992524+00:00",
  "ended_at": "2026-08-20T19:41:56.168574+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "cfe4863a-f94f-4ac2-80ca-40084e98dee2",
  "name": "gritty-amber-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 45840,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 183,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:02:56.316471+00:00",
  "ended_at": "2026-08-20T19:03:00.999008+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "418930d7-f952-46dc-a45e-d1cb6d2579f1",
  "name": "forlorn-gentle-polecat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 45356,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 180,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T18:57:09.904374+00:00",
  "ended_at": "2026-08-20T18:57:13.721650+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "6ab48fdb-7057-41d0-b4a0-9f16ad6614d1",
  "name": "icy-merry-jay",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 36392,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 177,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T18:48:25.735569+00:00",
  "ended_at": "2026-08-20T18:48:29.703658+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "fea947bc-dffa-4694-94de-10c2a24ac7c6",
  "name": "inland-buoyant-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 47804,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 183,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T18:46:43.512849+00:00",
  "ended_at": "2026-08-20T18:46:47.526633+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "cedb45f7-45f4-4290-8c5a-5e830d2a94f0",
  "name": "zealous-brave-wren",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 58298,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 191,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T18:45:56.222316+00:00",
  "ended_at": "2026-08-20T18:46:00.071802+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "aac58a6b-99c6-4176-b56d-31a99ac2f078",
  "name": "bitter-kindly-swallow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 49004,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 175,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T18:34:34.977960+00:00",
  "ended_at": "2026-08-20T18:34:40.491726+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "85c2fdb7-ab27-47c0-b817-a50a85d14c76",
  "name": "craggy-orderly-grouse",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "194.156.249.154",
  "src_port": 39574,
  "username": "dev",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T12:26:57.732690+00:00",
  "ended_at": "2026-08-20T12:26:58.704064+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a9072ebf-8ad8-4d42-883c-6c31dc897386",
  "name": "prairie-steady-seal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 47802,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 181,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T11:06:57.340152+00:00",
  "ended_at": "2026-08-20T11:06:59.216238+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 824
 },
 {
  "id": "3194b7b1-fd92-466d-88bc-8b6243b2b072",
  "name": "stoic-quiet-ermine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 39460,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 196,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T11:02:59.560764+00:00",
  "ended_at": "2026-08-20T11:03:00.440560+00:00",
  "ended_reason": "exec complete",
  "commands": 3,
  "transcript_bytes": 220
 },
 {
  "id": "5ee4453c-2f81-4420-a66c-694dbacf253d",
  "name": "faded-windswept-ermine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 53988,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 188,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:49:16.451572+00:00",
  "ended_at": "2026-08-20T10:49:17.078277+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 801
 },
 {
  "id": "f0978472-52ad-4c65-ba85-4babaf38ecf4",
  "name": "gritty-brave-starling",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 58374,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 246,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:44:08.200221+00:00",
  "ended_at": "2026-08-20T10:44:08.845028+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 812
 },
 {
  "id": "d6b47e36-d02e-4490-92ab-6298f355f1c7",
  "name": "ivory-lunar-lorikeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 53244,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 183,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:37:24.385787+00:00",
  "ended_at": "2026-08-20T10:37:25.037746+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 771
 },
 {
  "id": "e8ace699-f5ef-41c0-85cf-c5c9afd38fee",
  "name": "polar-nimble-mallard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 34960,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 198,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:26:37.704796+00:00",
  "ended_at": "2026-08-20T10:26:38.742451+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 865
 },
 {
  "id": "096efd99-b135-4bea-9b2f-d820f6a07c45",
  "name": "smooth-boreal-badger",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 55596,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 175,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:10:05.594657+00:00",
  "ended_at": "2026-08-20T10:10:05.963832+00:00",
  "ended_reason": "exec complete",
  "commands": 3,
  "transcript_bytes": 220
 },
 {
  "id": "2c8169e8-57bc-4f39-be8c-f260112e2d62",
  "name": "twilight-hollow-badger",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.47.66",
  "src_port": 42020,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T10:02:46.947440+00:00",
  "ended_at": "2026-08-20T10:02:48.687673+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8d240b26-91f0-4430-a6c8-3262dc97b166",
  "name": "regal-fleeting-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 36322,
  "username": "dev",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 217,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:02:46.494824+00:00",
  "ended_at": "2026-08-20T10:02:48.686744+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1656
 }
]